Kioptrix: Level 1 [Vulnhub] Walkthrough
Hello,Kioptrix are a series of easy machines in vulnhub, from kioptrix1 to kioptrix5. In this writeup i’ll demonstrate to you how to get root on kioptrix1.
Methodology
- Network Scanning
- Enumeration
- Exploitation
- Gaining root access
Tools:
- nmap
- enum4linux
- nikto
- searchsploit
So after deploying the vm, in vmware or vbox.., lets make an arp discover, cuz we need to know its IP.
can’t see the IP? or have any problems related to the VM(not being able to put it in nat)?, see the link below.
Okay, now we have the IP, lets make an nmap scan
nmap -sV -sC -v -T4 $IP -oN nmap.results
The scan shows up some open ports [22,80,111,139,443,1024]
We see that we have the smb port opened, let’s run enum4linux
enum4linux -a $IP
But nothing helpful honestly.
So let’s visit the webpage(port 80)
Looks like a default apache webpage.
Get Jawher Mastour’s stories in your inbox
Join Medium for free to get updates from this writer.
Let’s run nikto(which is a web vulnerability scanner)
The output tells us that the web server has a vulnerability in mod_ssl/2.8.4 AKA “openfuck”
So let’s use searchsploit:
And here we find some exploits for this version.
so let’s move the exploit to our cwd.
Then we need to compile the .c file:(i’ll name it exploit)
gcc -o exploit 47080.c -lcrypto
but before running it, we need to specify some parameters:(you can open the exploit’s file to know the code for your target, for us its 0x6b,0x6a will not work)
And we got our shell !
Privilege escalation:
let’s see what is the kernel version:
uname -a
2.4.7–10
After searching for a vulnerability for that kernel version, i foud this in exploitdb: https://www.exploit-db.com/exploits/3
after downloading this exploit, we need to transfer it to our “victim” machine, for this i used python http server,
Attacker:
Victim:
Then we need to compile it ,and execute it
And we’re root !
https://superuser.com/questions/1559882/vmware-player-doesnt-start-with-nat
