In this blog post, we’re going to solve the Brooklyn Nine Nine boot 2 root.
Let’s get started.
Going to the room, and pressing the start machine we get our IP address.
Here’s a screenshot of my IP address:
Next, let’s fire a terminal and see if we can enumerate the machine.
Going to the terminal let’s enter the command nmap -sV <IP address> in my case it will be nmap -sV 10.10.188.95
Doing this we get the following:
We see there’s an open port of FTP.
What can we do with FTP?
FTP can be configured where we can enter a username as anonymous with any password. Of course, this is NOT good security as there should be a valid username and password combination.
Let’s try it.
Going back to the terminal and enter ftp press Enter
Next enter open <ip address> in my case it will be open 10.10.164.245
Doing this we see:
We were able to login!
Next, let’s use the ls or list command to see what files/directories (folders) are on the FTP server.
We have one file – note_to_jake.txt
How can we download this file onto our terminal? We can use the GET command
enter get note_to_jake.txt to download the file onto our computer.
Afterwards, enter the command exit to exit the FTP server.
Now we’re back to our terminal on our machine. Enter the command ls -la which will do a long listing showing hidden files as well.
Doing this we see our file – note_to_jake.txt!
Now let’s open the file with cat note_to_jake.txt
We see:
OK – Amy is telling Jake his password is weak. This is good for us as we will need to use Jake’s login information to get into the system.
We’ll keep this in our toolbox.
Going back to the open ports, we now have SSH (22) and HTTP (80).
We can brute force the password using the hydra command. We’re going to enter the command hydra -l jake -P /usr/share/wordlists/rockyou.txt ssh://<IP address> -t 4
In my case it will be hydra-l jake -P /usr/share/wordlists/rockyou.txt ssh:/10.10.188.95 -t 4
Let’s break it down
hydra – command
-l jake – the user we want to brute force
-P /usr/share/wordlists/rockyou.txt – The wordlists (rockyou.txt) we want to brute force the SSH server with
-t 4 – we’re specifying to hydra that we want use 4 threads (more threads make hydra complete faster)
We found the password for jake’s login credentials for SSH. As you can see the password is not secure.
Now we’re going to log into the SSH server with the following ssh jake@<IP address> in my case it will be ssh jake@10.10.188.95
Doing this we’re prompted to enter our password which is 987654321.
After pressing Enter we’re in!
Now we need to find the user.txt.
How are we going to find this file?
Using the find command
In the terminal let’s enter: find / -name user.txt 2>/dev/null
Let’s break this down
find – the find command
/ – start at the root file system
-name – want to find a file by name
user.txt – the name of the file
2> – redirect errors from standard output (screen)
/dev/null – move the errors (from the 2>) to the /dev/null
Doing this we see:
We found the user.txt
Let’s open the file.
We found the user.txt code.
Now we have one more question – we need to find the root.txt
How are we going to do this?
Let’s see if we can do an escalation of privilege.
One of the first thing we can do is see if the user (jake) can execute any files or directories as root.
How do we check this?
Execute the command sudo -l
Let’s break this command down.
If the user (jake) is in the /etc/sudoers file then the above command will let us know what commands we can execute to get to root.
Entering the command we see:
There’s a command we can enter as to execute our privileges – less.
Let’s see how we can do this.
Doing a google search of less privilege escalation we see the following link.
Click the above link and scrolling down we see how we can do an escalation privilege under the sudo section.
Going back to our terminal let’s enter: sudo less /etc/profile (press) Enter) then enter !/bin/sh
Doing this we see:
Once we press Enter we’re back to the terminal
but if you notice the prompt has changed to a #
doing a whoami we see that we’re root!
Now let’s navigate to the root home directory (/root) to see if the root.txt is located there.
Enter the command cd /root to navigate to the root home directory
Doing a long list to show everything (ls -la) we see there’s a root.txt file!
In today’s post we’re going to solve the Bounty Hunter room in TryHackMe.
Let’s get started.
Going to the room and clicking the deploy/start machine, we see the following:
Your IP address will be different.
Let’s start answering the question.
The first question is to find open ports.
We’re going to enter the command: nmap -sV <deployed IP address> which in my case will be nmap -sV 10.10.126.62
Doing this we see:
We have three ports open. FTP, SSH, and HTTP.
Next question.
We need to see who wrote the task list.
With FTP depending on the configuration, you can access this server with a username of anonymous and any password.
Let’s see if this works.
It worked!
Now let’s do a listing to see what is on the server.
We have a locks.txt and a task.txt file
How do we download the files?
We can use the get command – get <file>
Let’s try it.
The files were downloaded successfully.
We can close the ftp server by entering the exit command.
Doing an cat (concatenate) to open the task.txt file we see:
We found the user – lin.
Let’s answer the next question.
What service can we use to brute force the text file?
Looking at the services opened, we already anonymously logged into the FTP server, so that’s not it.
Let’s see if SSH is the answer. It is!
Next question.
What is the user’s password? The user in this case is lin.
Well to brute force SSH we can use the program – Hydra.
We didn’t open the tasks.txt file.
Let’s open it.
Using the cat command cat locks.txt we see:
Hmm… this file seems like this is a file with passwords.
Going back to Hydra, doing this we can use the command hydra -l lin -P locks.txt <IP address> -t 4 ssh in my case it will be hydra -l lin -P locks.txt 10.10.126.62 -t 4 ssh
Let’s explain the command
Hydra – The program we’re going to use
-l lin – select the user we want to use (lin)
-P tasks.txt – selecting the password file we want
<IP address> – specifying the IP address we want to brute-force
-t 4 – the number of threads we want. In this case we say we want 4 threads. The bigger the threads, the faster hydra will perform
ssh – let’s us know we want to brute-force the ssh server
Doing this we get the following:
We found the password – RedDr4gonSynd1cat3
Now let’s login
Going back to our terminal let’s enter the command ssh lin@10.10.126.62
Let’s break this down
ssh – invoking we want to access the SSH server
lin@10.10.126.62 – the user at the server
We get the following:
We get the question of are we sure we want to connect – enter yes.
Next we need to enter the password. Copy the password from the Hydra output.
Doing that we see the above screenshot.
We are now in the SSH server!
Let’s answer the next question.
We need to find and open the user.txt file.
Doing a long listing to view everything ls -la we see:
We see the user.txt file!
Using the cat command to open the file it will be – cat user.txt
Now to the final question.
We need to find and open the root.txt file.
Going back to the terminal – we’re going to enter the command: find / -perm -u=s -type f 2>/dev/null
Let’s break it down
find – invoke the find command
/ – specifying we’re starting at the root file system
-perm = look for a specific permission
-u = s – specifies we want to find users (owners) with the sticky bit set. The sticky bit allows a user to execute the program as the owner. In this case we want to find sticky bits that can be executed as root.
-type f = we’re looking for files
2>/dev/null – we’re redirecting error messages from the standard output (the screen) to /dev/null.
Doing this we get the following:
The above files allows us to execute the program as root.
Most of these are standard, but the sudo command should not be there.
Why? The sudo allows to execute root commands for the specific command.
With the sudo command there’s also a file sudoers file that tells the users, and files that can run as root.
To figure this out, let’s enter the command sudo -l
We’re going to be prompted for the password which is: RedDr4gonSynd1cat3
Doing this we see:
We see that one file – /bin/tar can run as root.
Going to Google and typing in privilege escalation tar file
We see:
Clicking on the first link we see:
Scrolling down we see:
We see a section on Sudo!
Copying this command into our terminal and entering the whoami command we get:
We have successfully escalated our privileges to root!
Going to the root home directory and doing a long listing we see:
In today’s post we’re going to solve the RootMe room in TryHackMe.
Let’s get started.
Going to the room let’s deploy the machine. This will give us the IP target IP address.
Note: Make sure you’re logged into TryHackMe’s network through OVPN.
After the deployment is complete, we see the following.
Note: Your IP will be different.
Let’s answer the questions
First question:
We can press the completed button as we have successfully deployed our machine.
Second question:
We need to see how many ports are open. Let’s use the application – nmap. Nmap or Network mapper is used to find open/active services on a server.
We’re going to use the -sV (all) command to get find the version numbers of the active services.
Let’s open a terminal and enter the below command.
The complete command is nmap -sV <IP address from deployment> in my case the command will be nmap -sV 10.10.239.135
A screenshot below shows:
2 ports are open. 22 and 80. Corresponding to SSH and HTTP.
So the answer is two.
Entering this into the text box and pressing Enter, we see that is the right answer.
Moving on to question 3.
Going back to our screenshot above of our nmap results we see the version is Apache 2.4.29. Entering 2.4.29 into the text box and pressing Submit we see that’s the correct answer.
Now to question 4.
Going back to our nmap scan we see that for port 22 the service is SSH (case matters!)
Entering this into the text box and pressing Submit we see that is the correct answer.
Question 5
We need to find directories on the web server using the GoBuster Tool.
First we need to figure out – what is the web server?
Going back to our nmap results, the web server is port 80 or HTTP. HTTP stands for Hyper Text Transport Protocol. You’re using the HTTP protocol right now by viewing this blog post. When accessing the internet, and typing in http is invoking the above protocol.
Now that we know that the web server is port 80 or HTTP. How do we access the GoBuster tool?
Well if you’re using the Parrot Security or Kali virtual machine (or attack box on TryHackMe) all you need to do is open a terminal and type gobuster
To access the different directories we’re going to enter the following command gobuster dir -u http://<ip address from deployment> -w /usr/share/wordlists/dirb/common.txt. In my case the command will be gobuster dir -u http://10.10.239.135 -w /usr/share/wordlists/dirb/common.txt.
Let’s break this command down
We enter gobuster to invoke the program
dir to specify we want to brute force or view all directories
-u http://<ip address from deployment> – specifies we want to view all directories from this website
-w /usr/share/wordlists/dirb/common.txt – specifies we want to use this file as our wordlist to find the hidden directories.
Entering the above command into a terminal and pressing enter we have the following:
Let’s explain the numbers next to the results
The numbers are HTTP codes and can tell you a lot of information
Let’s break give a brief breakdown of the different codes
HTTP Code 200 – OK – meaning the website rendered correctly
HTTP Code 301/302 – Redirection – meaning the website will redirect to another page. Pages with this number you should delve deeper into by visiting the actual page
HTTP Code 401 – Unauthorized – meaning you’re not authenticated (or logged in) to view the page
HTTP Code 403 – Forbidden – meaning you’re not authorized to view the page
From the screenshot above we see a few 301’s (redirects) that we should check out.
Question 5 is a gimme/free question as it says no answer is needed, so press Submit to collect the points.
Now, on to question 6
We need to find the hidden directory.
Looking at our gobuster results and what we know about HTTP codes, the 302 are the results we should focus on. Looking at the results and the number of characters the question is looking for – we can surmise the answer is panel.
Entering /panel/ into the text box and pressing Enter we see the assumption was correct.
We can also double check this by opening a web browser and entering the following http://<IP address from deployment>/panel
Doing this on my machine – I see the following
Again – just because we see a redirect doesn’t mean the page will not render. Always check 301 and 302 HTTP codes!
Now on to question 7.
First we’re in a new section of the challenge titled – getting a shell. This is where things get interesting…
What is a shell? Well there are two types of shells
Bind shell – need to have a listener running on the target machine. How bind shells work is the attacker connect to the listener on the target machine to gain a remote shell. This is a two step process. Also, the listener has to be on the target machine. If it’s not this type of shell will not work.
An visual example of a bind shell:
Note: The -e /bin/sh specifies to send a Bourne shell to the attacker’s box
Reverse shell – listener is on the attacker machine, and the target connects to the listener on the attacker machine with a shell. This is the best option as it removes having a listener on the target machine. Also reverse shells allows to be done on popular ports such as HTTP
In our case we’re going to use a reverse shell.
How are we going to do this?
We know that we have a secret directory named – panel. When we went to this page we also noticed that we can upload files.
Let’s try to upload a php file that has a reverse shell attached to it.
Copy the code and open a text editor and paste the results.
Scrolling down we see a few lines that need to be changed.
I’m going to explain this below.
The two lines we need to change are our IP address and port.
The IP address is going to point to our IP from our TryHackMe account. You can find the address at the top of the page in green. My address is 10.13.2.231. This will be considered the Attacker’s box.
The port we can make anything we want. In this case let’s make it 1234
Save the file and exit the editor.
Now doing a listing (ls) we see the following
We need to change the permission to have the file execute. To do this we enter the command chmod +x test.php
Now let’s go to the panel directory.
Opening a browser and entering http://<IP address from deployment>/panel, we see the following. Let’s try to update our test.php file.
After pressing upload we see there’s an error. PHP files are not permitted.
How can we fix this? Well, let’s try changing the extension from PHP to PHP5.
Going back to the terminal let’s enter the command: cp test.php test.php5. This will create a new file named test.php5.
Doing a listing (ls -la) we see that the file is created.
Going back to the panel directory let’s browse and select test.php5
After pressing Upload we see that the file was uploaded successfully.
We see the file was uploaded, but how do we get to the file? Going back to to our gobuster results, we see there’s another 301 named uploads. Let’s try to navigate to this directory.
Opening another tab and entering http://<IP address from deployment>/uploads we see the following:
Our test file is here!
Now how do we connect to the target box?
First, we need to open a new terminal and enter nc -nvlp 1234
Let’s explain what’s happening:
nc – is a program named netcat. You can think of netcat as a swiss-army program that can do a lot of information. In our case, we’re going to use netcat to set up our listener on our machine.
nvlp – this is a series of parameters that do the following not resolve names, verbose printing, listen, on a specific port
1234 – is the port we’re going to listen on. **Make sure this matches the port inside your test.php5 file, otherwise the next steps will not work**
Going back to the tab with the uploads folder, click on the test.php5. You will notice the application is running and seems to hang. This is what we want.
Going back to our terminal where we set up the netcat listener, we have input! Our reverse shell worked successfully! We’re officially on the target machine!
We can prove this by entering the command whoami which will give us our current user. The current user is www-data which signifies the web user.
OK, we’re on the machine, but how do we find and open the user.txt file (we need this to answer the question). We need to find it on the file system.
Entering the command find / -name=user.txt 2>/dev/null
Let’s explain this command:
find – is the program we’re using
/ – specifies we want to start at the root
-name user.txt – specifies the file we want to find on the file system
2 >/dev/null – specifies if there are any errors – such as we access denied, send that output to /dev/null. In other words do not output it to the screen.
Entering this in the terminal we see the following:
The user.txt is at /var/www/user.txt
Navigating to the /var/www directory using the cd (change directory) command, we need to view the user.txt file. We’re going to do that with the cat (concatenate) command.
Doing this we see:
We found the answer!
Entering THM{y0u_g0t_a_sh3ll} into the text field we see it’s the correct answer.
Now on to question 8.
OK, we need to search SUID permissions to find a weird file.
First, we need to describe what is a SUID. SUID or a user sticky bit is a permission inside of Linux that allows an application to run as it’s root owner. This is good for system administrators when they want to run commands without switching users. However, there are times where these files are overly permissive or too open for anyone to run. With these files we can do something called privilege escalation which means we can upgrade our user from a regular user to an admin/super user.
How do we find files that have the sticky bit turned on in Linux?
Well we enter the command find / -perm -u=s -type f 2>/dev/null.
Let’s break this down
find – the program we’re using
/ – start at the root of the file system
-perm – specifies we’re looking at permissions
-u=s – specifies we’re looking for the SUID. u is user, and s specifies the sticky bit with execution turned on. If we didn’t want execution turned on we would use S (this wouldn’t help us as we need to execute the program)
2>/dev/null – specifies if there are any errors (such as permission denied) send it to /dev/null
Looking at the output, some of these files are standard. There is one file that looks suspect. The file is /usr/bin/python.
Entering this in the text box we see this is the correct answer.
On to question 9
We need to escalate our privileges to change from www-data to root.
From question 8, we see that /usr/bin/python is the weird file in question that shouldn’t have the SUID bit on. We’re going to use this file to escalate our privileges from www-data to root.
Going to this site and scrolling down we see a section to escalate our privileges using python. Let’s go back to the terminal and enter the command
Let’s break this down
/usr/bin/python – specifies we want to execute the python program
-c = execute the following command
‘import os; os.execl(“/bin/sh”, “sh”, “-p”)’ – specifies we want to import the os library. Then we’re going to execute another command execute command line (execl) with the following parameters:
/bin/sh – specifies we want ot use the Bourne shell
sh – we’re specifying the file or the shell
-p – specifies the command we want to use
This question is a gimme so we can click the completed button.
Now, on to the last question – question 10.
We need to find the root.txt file
After the above command and doing a whoami command we see that we’re root!
Now we need to read the root.txt file
Navigating to the /root folder and doing a listing (ls -la) we see the root.txt file!
Opening the root.txt file with the cat command, we see:
Entering the above THM{pr1v1l3g3_3sc4l4t1on} into the text box we see that’s the correct answer and we have solved all the challenges.
In this post, we’re going to solve the Hemisphere boot2root from Vulnhub.
Let’s get started.
When we start the Hemisphere – Gemini machine we see the following screen:
OK, we’re prompted with a login screen.
For most boot2root’s we need to find user and root.txt on the box.
Next, on our attacker machine (I’m using parrot security), I am going to type the command netdiscover.
Netdiscover will ping your network with active IPs. From there you can figure out which IP is being used for the virtual machine.
After finding the IP address, let’s open a terminal and type nmap -sV <IP address from netdiscover>. In my case, it’s going to be nmap -sV 192.168.1.132. Doing this we have the following output:
We have 5 ports open.
FTP
SSH
HTTP
And ports 139 and 445.
What do the above two ports belong to?
Well these two ports are for Samba SMB. SMB allows computers to talk with each other. Most times when SMB is enabled, it’s SMB 1.0 which is extremely insecure. So how do we exploit it?
Well, there’s an application enum4linux which will enumerate all of the SMB shares. To do this we’ll use the command enum4linux -a <IP address from netdiscover>. In my case it will be enum4linux -a <192.168.1.132>
Doing this we have:
As you can see we have A LOT of output from enumerating the different shares from SMB.
Looking through the input we see there’s a username: William. We need to save this as we’ll use it later.
Now reviewing the nmap scan again – we see that port 80 or HTTP is open.
Next step, is to enumerate/brute force to see if we can find hidden directories.
Let’s use our two favorite applications – dirb and gobuster.
We have an assortment of files/directories to review.
robots.txt – a helpful file that tells web crawlers to exclude directories to be crawled/exposed on the internet.
Going to the robots.txt file we see:
There are three directories. Let’s see if we can find any goodies!
Going to the secret folder we see:
Hmm… there’s nothing there.
Let’s try admin.
Nothing there either.
Let’s try the last folder – lol
Nothing there.
So the robots.txt was a red herring. It’s a way to knock us off our game as there’s nothing there.
Going back to dirb/gobuster we see there are two folders to review.
Let’s try assets and see what we get.
Going to the assets folder we see:
Hmm – nothing really there. It’s styling for our website.
Let’s try the second folder – images.
Going to this folder we see:
Nothing of importance. This directory is a space for all of the pictures for our site.
Speaking of our site. Let’s go to the index.html file
Going to this page, we see:
Looking through the page we don’t see anything of value.
So now – we’ve enumerated all of the hidden folders and really haven’t found anything. We know we have a user of William, but how do we log in?
We need to enumerate/brute force the directories again.
How do we do this? Change our wordlist.
Going back to gobuster – we’re going to use the dirbuster directory-list-2.3-medium.txt which has more directories to check.
Entering the updated command we see there’s a new folder – portal. Let’s go to that page and see what we get.
Entering this into the URL we see:
Another page. It’s written in Spanish. We see there are three links at the top. Let’s click on the second (Sobre Nosotros) and see what we get.
Nothing to render/view.
But there is something interesting. In the address bar we have a view parameter. Which is pointing to the about-us.html page. Whenever we see a parameter field we should try to do a Local File Inclusion (LFI).
LFI is a vulnerability where you can access the files in the underlying filesystem. Let’s try to access the /etc/passwd file.
In Linux, the /etc/passwd file holds all the users. Let’s try it.
Let’s break this down.
We have five ../. What is this? Well we’re using this (../) to navigate one folder up. Meaning we want to access the parent directory of our current directory. Finally, when we’re at the topmost area of the file system. We’re telling the application to go to /etc/passwd.
Doing this the webpage displays the /etc/passwd file which reveals all of the users!
When you look in the file we see that there is a user named William. That let’s us know our enumeration from the enum4linux command worked correctly.
Now we have the user William, and we can do LFI on this application. What’s our next step.
Well we know that port 22 or SSH is open. We also know there’s a public and private key for all the users to log into the server.
We have a user of William. So we know he’s a valid user. How do we find William’s public and private key?
These keys will be in his home folder.
In Linux, every user has a home folder which allows the user to save files that can only be accessed by them.
With the public and private keys for SSH, we know it’s stored in a hidden directory titled – .ssh and saved in the id_rsa file.
id_rsa is the private key file
id_rsa.pub is the public key file
We don’t want to access the public key file as it’s accessible to EVERYONE. Hence the name.
We want the private key (id_rsa).
Let’s see if we can access this folder through LFI.
Success! We’re able to access the private key. We’re going to need this to log into the SSH server.
First we need to save this key.
To do this, right-click on the file and highlight the text, copy the text.
Open your favorite word browser, and save the contents as id_rsa (the name is important!). Also make sure you know where you saved this file!
After saving the file – let’s do a ls (listing) in the terminal
We see our id_rsa file.
Now let’s try to log in the ssh server.
Enter the command ssh -i id_rsa william@<IP address from netdiscover>. In my case the command will be ssh -i id_rsa william@192.168.1.132.
Uh-oh. We can’t log in as the permissions are too permissive or too open.
Press Control-C to get out of the prompt, we’re going to change the permissions of the id_rsa file.
To do this we’re going to enter the command chmod 600 id_rsa.
After entering this command, do a listing (ls) to view the permissions.
For the id_rsa file we see there is rw in the 2nd and 3rd position. These positions belong to the owner. In this case the owner would be parrot (column 4 in the above screenshot).
Now let’s try to log in again.
Success! We’re in the SSH server.
Now let’s do a listing to see what we see
We have the user.txt file. Let’s open it.
Enter the command cat user.txt
We have the user flag. Now to find the root.txt.
How are we going to do this?
Well there’s a few things we can do.
Since this is a Linux system, let’s enter the command sudo -l
This command will see if a user can elevate (or escalate) their privileges without being the root user.
Entering the command we see this program doesn’t exist.
OK, so we can’t use that.
Remember how we had to change the permissions to gain access to the server?
Well I wonder if we can check files that are overly permissive and use one of those files to elevate our privileges.
What command would we use?
The command we enter is find / -perm -u=s -type f 2>/dev/null
Let’s break this down
We’re using the find command
the / specifies we want to start at the top of the file system
-permu=s specifies we want to find users that have the sticky bit on.
What is the sticky bit? Sticky bit in Linux specifies we can run an application as the owner of the file.
We want to access the root.txt, so we know that the superuser root is probably the only user who can access this file.
-type f = specifies we want files
2>/dev/null specifies that any errors go to the /dev/null file.
Entering this command we see:
Most of these files are always there but we have a file that shouldn’t be there /etc/passwd.
Why shouldn’t this file in this list? Well the /etc/passwd file holds all the users in the operating system.
This file is overly permissive. We see we have read, write, and execute.
So what do we do? Add another root user.
How do we do this?
First we need to create a password. We’re going to use the openssl command to create a suitable password for the /etc/passwd file. I’m going to select a password of password. See the screenshot below.
Next, we’re going to add our new user in the /etc/passwd file. How are we going to do this?
We’re going to use the echo command.
Let’s break this line down.
echo is a command in Linux. We’re going to echo what is in quotation marks.
We’re going to create a user of test
Next, we enter the password we created with openssl
Next, we have the numbers of 0 for userid and groupid. 0 represent root.
Next, we have the name of root
Next, we specify the home folder for root which is /root
Next, we have the shell for this user which is the bourne again shell (/bin/bash)
Finally, we’re appending this input to the /etc/passwd
Pressing Enter we are prompt back to the command line
Using the command su (switch user)
and enter our new user of test and password of password
We see that the login was successful.
Entering the whoami command we see that our user is now root. Which means our privilege escalation worked!
Now that we’re root let’s navigate to the /root folder and do a listing
Cool, we see the root.txt file.
Opening this file we see:
Success! We found the root flag!
*****If you’ve read to the end – I wanted to add that I am now on @buymeacoffee! If you like the above content and want more of it. Please support: https://www.buymeacoffee.com/thefluffy007
What’s different between version 1.1.2 to version 2. Well… keep reading
In version 2 I added more dynamic analysis tools such as MARA, PIDCat, QARK. In the pentesting section, I added Metasploit. I also added MobSF (a one stop shop with dynamic scanning for android applications) in a docker container. In version 1.1.2 I tried to upgrade my python version to 3.7.5 and broke my Linux build (could not update the distro).
After speaking with Anant (owner/creator of @AndroidTamer) we decided to put MobSF into a docker container to keep it contained and not break our build.
I also created the virtual machine from a vagrant machine, as I realized with version 1, I severely underestimated the storage I needed to include all the programs I wanted. I also included insecure android apps to test in the Documents folder.
Interested in learning more – download/use the virtual machine at the following location:
In this post we’re going to solve the Cofveve virtual machine.
Let’s get started
After downloading the virtual machine and starting it we see the following:
Using the netdiscover command we can find the IP that the virtual machine is using
Going back to our attacking machine (I’m using the parrot virtual machine).
Doing an nmap scan with the command – nmap -sV <IP address from netdiscover command>, we see the following
There are three ports that are open – ssh, and two http ports.
When http ports are opened the next step is to try to do a recursive brute force attacks to find hidden directories.
We’re going to use two programs – dirb and gobuster.
Doing the dirb of port 80, we get:
Using gobuster we see:
We see that both of the programs did not return anything.
Let’s try to the following programs with the 31337 port, let’s start
We see five files – a robots.txt, and four hidden files (start with .)
The robots.txt gives information about sites that should not be crawled by the internet. This is useful as it will give us files or directories (folders) to review to get more information.
Going to the robots.txt we see:
Hmm, there are three directories that are disallowed. Let’s try to go to them.
Let’s start with taxes. When navigating there we see:
We found the first flag!
Going to the second directory .bashrc we see
Hmm, it’s a file, let’s save it.
Going to the last directory of .profile we see
Another file to save.
Going back to either dirb or gobuster results we have one more directory, .ssh.
This is strange. The .ssh which is hidden should not be exposed on the internet. This folder has information about how to login into the system. Such information is a private key (which only the user should know) public key (which everyone knows), as well as other things.
Going to this folder we see:
We see three items, which look like additional files.
Let’s see if we can navigate to these files.
Navigating to the first item, id_rsa we see:
Another file, so let’s save it.
Let’s try the second file – authorized_keys. Going there we see:
Another file, let’s save it.
Finally, let’s go to the third item – id_rsa.pub
Now that we saved everything let’s go back to our virtual machine and open the files.
First, let’s open the id_rsa.pub file. This file is the public key that is part of a pair. The other pair is the private key. As the name suggests only the user should know their private key and not expose it to anyone else. The public key can be exposed to everyone.
Opening the file we see:
We see a ssh-rsa. RSA is a cryptographic algorithm. Looking at the end of the file we see a valid user – simon@covfefe. We need to save this user as we will need it later.
Opening the id_rsa file we see:
This file is the private key to log into the SSH server as Simon! This is bad, as I said before this file should NOT be exposed as Simon private key should only be known by him only.
Opening the authorized_keys file it has the same content as the id_pub
How can we use this information?
We know a user (simon@covfefe) and a private key.
Well we can log into the ssh server.
Let’s start.
We can use the command ssh -i id_rsa simon@covfefe
Let’s break this down.
We’re logging into the SSH server, specifying a file id_rsa (Simon’s private key) and the user of Simon
We get the following output:
Uh oh – we received an error:
The private key is too open. We need to change the make it less accessible. To do this we’re going to change the permissions from 644 to 600. What this will do is give access to the owner in this case parrot (which is us).
To do this we will use the command chmod 600 id_rsa
Trying to log in again we have the following:
We need a passphrase… which we don’t have. How do we get this?
Doing a good ol’ Google search of cracking passphrase for id_rsa we see the following link
We see there’s a command ssh2john which can be used to crack the passphrase. Let’s do it!
First, we located where the ssh2john command lives in the file system. Next, we’re going to create a hash using ssh2john. We’re going to use this for the next step.
Next, we’re going to send our hash to john which will be used to crack it. We’re going to use the wordlist rockyou.txt which is a common wordlist used to crack passwords. Doing so, we found our passphrase – starwars.
Running our SSH command again, we enter the passphrase of starwars and we’re in the system!
Doing a long listing and showing all of the files (ls -la) we see the files we found before when brute forcing the directories. Let’s look at the .bash_history. This file is good to review as it will let you know commands that were executed on the machine.
Opening this file we see a read_message and then exit. What is read_message? Is this a program?
Executing the read_message we get a prompt. Let’s enter the name Simon. We received a message stating this is is a private messaging system and the source code is in the root directory.
Navigating to the root directory and doing a long listing with all the files (ls -la) we see there’s a read_message.c file, and flag.txt!
Opening the flag.txt file we see a permission denied :-(. Looking at the long listing again this file (flag.txt) can only be accessed the owner, which in this case is root (column 4). I am the user Simon, so I can’t view the file.
Opening the read_message.c file, we see source code, and… the second flag!
And it’s giving us a hint – we need to review the source code.
Looking at the source code we have a buffer (buf) that is holding 20 characters and is executing another file program which is pointing to /usr/local/sbin/message. Whenever we see buf we need to think of buffer overflows.
Buffer overflows are a vulnerability where you overflow the input to access other parts of the computer system. In this case, since we have a holding space of 20 characters – we’re going to overload the buffer with characters OVER 20 characters. Also we’re going to try to change the shell to /bin/sh <— bourne shell. We’re going to change the shell to escalate the user. Changing from Simon to root. We need to be root to open the flag.txt file.
Let’s try it.
Running the commands id and whoami we see we’re root!
Now let’s open the flag.txt and see what’s in the file.
As the title suggests, I am working on the second version of the virtual machine I created in 2019.
I put myself out there and decided to create a training on Mobile Security and Bug Bounties – something I wanted to learn and am still interested in.
I noticed there was a virtual machine titled – Android Tamer, score! Well… not really. At the time, Android Tamer was SUPER out of date. Speaking with the creator, Anant Shrivastava about my dilemma needing a virtual machine for my training. Anant told me that it would be easier to create my own virtual machine as opposed to fixing the current version of Android Tamer.
Creating my own virtual machine? I’ve never done that before. Challenge accepted!
Anant, was SUPER helpful with all of my questions and guided me on creating the virtual machine. In about a month the first version was created. Yay!
After the training, I asked for feedback and decided I needed to revamp the virtual machine to make it more accessible/user friendly.
I added and updated out of date software in the virtual machine.
Then I noticed – I was running out of memory when trying to do my upgrades.
I realized at that moment, I totally underestimated the size of the virtual machine.
So, at this time I am revamping the virtual machine and starting with a barebone version of Ubuntu 18.04 (this is the OS the first version was built on) from Vagrant. Again, Anant gave me this advice when creating the first version. I didn’t go down that path as I never heard of Vagrant.
Speaking of Vagrant – shameless plug – I created a course through Cybrary on Intro to Vagrant. The course can be found here.
I started on the quest to version 2 yesterday (Sunday February 7, 2021), and I must say it was trying, yet fun.
Once I created the vagrantfile and started the vagrant box I realized I was dealing with the command prompt. I knew this wasn’t going to work and I needed to add a user interface. Looking on the internet, I found the lightdm and tried installing it. Once I rebooted my virtual machine, I encountered the error “could not log into session.” The login did not work.
Putting my research hat, I found the following link on how to remediate the no session login. Hmm, the ligthdm is using an older version of the unity framework that needs to be removed.
Rebooting the machine – it was a…
Somewhat success.
I had a user interface, but I didn’t like it. See tweets below
: Here's a screenshot of the VM. I want to have the same look and feel as Ubuntu 18.04. Need to do more research. I'll probably create a blog when I'm done. #MobileSecuritypic.twitter.com/90ihMytwCt
I wanted the user interface to have the same feel as the 18.04 Bionic Beaver operating system.
Doing even more research I found that 18.04 Bionic Beaver is using the MATE desktop.
Back to Google I go. I found a great site on how to install MATE onto a Linux operating system.
Somewhat score? The user interface is getting close, but not there.
: Progress!!! Research showed 18.04 Bionic Beaver was using MATE desktop. So scrapped my original VM, created a new one in #Vagrant and installed MATE desktop. Here's the update… pic.twitter.com/Cnzzl6KoH5
Going back to the site above, I noticed that I installed the wrong version of the MATE desktop. I installed just the MATE desktop without the bells and whistles.
Looking at the bottom for the Ubuntu section it states – “
Alternatively you may choose to install Ubuntu MATE Remix.
Ubuntu MATE is a more comprehensive option that offers a slightly tweaked layout, configuration, and themes to integrate into Ubuntu in a more seamless fashion. This will install the complete MATE Desktop Environment as well as LightDM and numerous other applications to provide a full and well rounded desktop.“
Once I installed the Remixed version – I finally found success!
Now that I have the interface I wanted – it’s time to add the tools and insecure apps.
Yes, that’s what set my virtual machine apart – I have insecure android apps installed in the virtual machine for students to learn mobile and android hacking as well as the common programs needed to perform mobile and android hacking.
On Friday February 5, 2021, I provided a training on teaching Application Security concepts using the OWASP Top 10.
The Open Web Application Security Project or OWASP is a non-profit organization whose mission is to make application security better. Members of OWASP meet every few years to create a top 10 list of the prevalent vulnerabilities in the industry. The last list was from 2017.
The structure of my training is the first part is to present the theoretical part – concepts and definitions. The last part of the training is a practical or application of the first part of the training (theoretical).
For the practical piece I used the website – BodgeIt Store. The BodgeIt Store is an insecure app, that should NOT be deployed in commercial servers. Many will say that the BodgeIt Store is a SUPER old insecure app (it’s close to 10 years old).
The app is close to 10 years old, but I find this app is good to teach application security as there’s a scoreboard and 12 challenges to complete.
Anyway, without further ado below are my slides from my training
I also provided documents that provide a walkthrough of the BodgeIt store as well as installing and using an interception proxy such as Burp Suite.
Finally, I included instructions on how to import the OWASP Broken Authentication VM which have a series of insecure apps.
During the weekend I participated as a speaker at the Blacks in Cybersecurity Winter Conference. This conference was online, and was a GREAT experience. I learned a lot of information and was able to meet with a lot of people and recruiters.
Anyway, my training today (Saturday February 6, 2021) was on reversing an Android application. In my training I talked about how apps are not safe by showing case studies (as recent as last week!) along with describing the components of an Android app. Next, I talked about how to reverse an Android app and how to do dynamic analysis using Frida. I finished the course by having a lab where I put all of the pieces together with the UnCrackable-Level1.apk.
Note – The virtual machine we’re using for this training is one that I created. The VM is titled, IntroToAndroidSecurity version 1.1.2. This VM has the common tools for Android Hacking in one place. I also included insecure Android apps in the virtual machine as well for participants to continue their learning/growth in mobile security. For the training I also used an Android emulator (Androidx86). I did this as I wanted all the participants to be on the same playing field. If we were doing mobile security as a job, we would want to have a real physical device.
Without further ado – here are my slides from the training.
Also, if you want to download the virtual machines (IntroToAndroidSecurity and Androidx86) from my training go to my Source Forge link here.
Note – Click on the External Links tab to get the VMs.
I am also including the documents I created for this training as well –
To set up the mobile lab, you will need the first two documents. I included the third document just in case the second document (importing Androidx86) does not work.
Document 4 is the walkthrough of the lab that I completed during the training.
