So welcome to walk through.
Number six we're really working on a machine called nibbles.
So nibbles is at ten ten.
Ten.
Seventy five is a Linux machine.
So go ahead and get your and map scan started now and we're going to be doing this for the last five
videos of the course.
So start your end map scan now and then go ahead and join when you are ready to go your end that results
are back.
If you're just following along that's absolutely OK just go ahead and let the video play through.
If you're scanning go ahead and join us when your scan is ready.
I'll see you over when you're done.
All right.
Now on our Kelly machine taking a look at our map scan we see that there are two ports that have returned.
One is Port 22 which is SSA H.
And the other is port 80 which is H TTP.
Now in this scenario it's actually quite common.
And we've talked about it in previous videos where you see something like Port 20 to import 80 and that's
it in this vector especially on easy machines like this for capture the flag typically port 80 is the
way in and port twenty two would be utilized in some way later on you might get a reverse shell in port
80 you might find credentials on port 80 something here might lead us to a nice shell here later on.
Typically the version of SSA age is not the way in.
There's not like usually RC E's or remote code execution on versions.
So we could search definitely eyes open SDH and see if there's anything out there.
My guess would be there isn't on top of that we see that there is Ubuntu running on the machine.
So this would be useful information for us just during information gathering process.
So we'll store this in our back pocket and note that it's running Ubuntu on the back end.
So we already know we're up against a Linux machine on top of that we can kind of tell we're against
a Linux machine with the SSA and the Apache here.
So again open to showing here on this HP Service.
So a couple things that we can do is we can look for exploits against Apache as well.
So for example in the tool that I haven't shown you but wanted to show you is a tool called Search split
so we could say hey we've got Apache open and maybe we want to just quickly.
No.
Is there any kind of exploits for this two point four point one eight.
Well we come down here and we can start typing in search point and just go ahead and tab and autocomplete.
Now the thing I will say about search Boy is that you don't have to be very specific if you're very
specific with your query.
It's actually worse off for you.
And I'll show you an example so if you say Hey I'm up against Apache two point four point one eight
it's going to say I didn't find anything but if we back that out a little bit and we say hey we're against
Apache two point four OK.
Now some stuff starts showing up when we get very version specific like this we might actually miss
some details in terms of exploits as you can see here there's an exploit right here from two point four
one seven to two point four point three eight and this two point four point one eight actually falls
in line in here.
So it's important to note that let's not be too specific if we use this search by tool.
Now what search Boyd is doing is it's pulling down from exploit database which is actually already pulled
down and updates on your machine since Cally the owners of Kelly landings also run exploit database.
They have a nice little repository of all the exploits that are on exploit database on your machine.
So we're just doing an offline search here we don't you have to touch the Web to do this search in any
exploit that has been pulled down is available on your machine.
You can see we have a shell script here P.
If we see a derby for Ruby that means tremendous flight module most of the time so we could see those
things as well.
And for example on this exploit we can tell some other things as well.
It's a exploit for Linux that's good that checks a box but it's a local exploit.
Meaning we have to be on the machine or some sort of already have access to it.
Right.
To exploit this.
So this isn't going to work for us.
We're more after a remote exploit of some sort.
And we're really not after any kind of denial of service exploits typically especially in a real pain
test those are out of scope.
But when we're talking about having a capture the fly like we're doing here these are really IOSCO.
We don't want to deny service to our box there's no point in doing that.
Now say this was a two point four point one seven and we know it's vulnerable to denial service on a
report.
We would actually write this up.
We'd absolutely write it up.
We would note Hey you know this version is vulnerable to X Y and Z including denial service see these
write ups here as to what can happen if it was running on Windows.
So let's go ahead and do a little bit of further enumeration.
I don't think Apache two point four point one eight is actually the way in here.
So if we go out to the inter webs and we just say 10 not tend to attend that seventy five and we get
a hello world OK.
So not a lot to go on here.
There is a few things that I always do when I when I first get to a web page and I'm going to note that
this box does teach valuable lessons.
Again we're starting to get off of the really really easy machines and this is still going to be easy.
This is going to feel more.
Capture the Flag like than anything else that we've done so far and that's OK.
We're starting to get into some of these hack the box machines that are going to feel capture the flag
and our take on this is going to be that from a realistic perspective as much as we can do.
But there are going to be some methods along the way that we're going to encounter that are going to
be capture the flag on top of that there's going to be homework that I'm going to give you a good machine
here towards the end that I think is going to allow us I've skipped a couple machines that are really
easy and kind of repetitive of what we've done.
I'm going to get that as homework to allow us to test our knowledge and see where we need to fill in
gaps and then we'll do a quick review video for that here in the future.
But I'll give that out towards the end of the video so back into this session here few things that we
can do from this point we can go ahead and start up Nick doe scan and do some vulnerability scanning
and this web page.
We can take the directory here and do some directory busting because if we do see this and this is all
we have we don't have any links or anything.
Maybe there's something running on the back end of this.
The server here and we'll have to use directory busting to find that on top of that we can do some enumeration
here if you have a tool called appetizer.
Now appetizer is a great tool.
You can see here that we've pulled down Apache new bun too.
If you don't have an appetizer installed I do recommend just googling weapon Kaiser here and installing
this plugin for your Firefox so from here.
Let's go ahead and just right click and view the source.
I said this to you guys before but again especially and capture the flags they like to hide little comments
and the source code.
This is a realistic perspective in the sense that we should be looking for comments and source codes
by developers.
We should be looking for hardcoded credentials and anything of value that might be in source code.
So it's always important to look at the source code as you can see here there is a comment pointing
to a naval blog directory.
So where it is going to copy this and come over here and I'm just going to type it out but go into Naval
blog not the IBM page just like this and you'll see that we are given this nice little blog here you
can see navels.
Yum yum.
And we've got that hello world and not a whole lot of anything else.
You got some categories we can click around enumerate see if there's anything here that we can do.
And for the most part we are pretty stuck.
We can view the source code and see if there's any information on this nibbles blog here if we can see
any kind of version or what it's running on with a platform.
I'm not seeing anything right off the bat.
We'll come back and also look at the appetizer and see if there's anything of interest here.
OK.
It's running on J.
Query.
It's running on BHP.
That may help us if we get some sort of exploit going for this.
So in terms of what we see there's nothing readily available.
I don't have anything to exploit.
So the next thing that we would do here is we would do a quick search point on this.
We can just say search boy I can type in the panel here search flight and we'll do say something like
nibbles OK.
That didn't work.
How about nibble.
See I got too specific there.
OK.
So it is actually called nimble blog and we can see that there's a couple of exploits out for it.
One is a version three and it's got sequel injections on the web app and then we've got a four point
zero point three that's very specific on an arbitrary file upload that allows remote code execution
and it's a derby which means that this is a Metis flight module available.
So what's the difference between these two.
Well a single injection can lead to a shell.
It can lead to database Dom say can lead to a lot of malicious stuff but not always.
You could get sequel injection and not find anything of interest on the attack side.
This thing here this arbitrary file upload with remote code execution way more juicy remote code execution
means that we could be sitting at our house exploit this and get code execution and talk back to us
without ever having to be local.
OK.
So in terms of the nastier exploit it's this all the way.
Now we don't know what either these do but the one I would be eager to look at is this four point zero
point three.
So in order to do that I'm just going to boot up Mattis point really quick and we can actually load
up that module and see a little bit more information.
We could also go out to the Web and do this to look at the file and we could actually probably read
the ruby file and pull the information down.
But just in a clear cut way let's just search naval real quick and then we'll just copy this guy here
and say use paste and then all we have to do is type info.
So from info we can see the description here it says no blog contains a flaw that allows authenticated
authenticated remote attacker to execute arbitrary BHP code.
This was tested and four point zero point three.
We've got a blog about it here we've got the details.
Very interesting stuff.
But if it says authenticated that means we need to authenticate.
That means there's probably some sort of log in page somewhere.
So what can we do here.
Well we don't see an ad in panel or log in page or anything.
We could just type in ad men and get lucky which is what I did right off the bat.
I just typed an ad in that page and found it.
Now there are other methods to doing this as well we could go into a new tab here and we could run something
like a door buster and endure buster or we could copy this address here like this and just paste it
and then add in the 80 at the end right here like this now my typical settings would be to say to go
faster on this and we can browse to our file and do something like base here and then we're gonna go
to user go to share and just start typing worried less so type in w o and you'll see word list comes
up second in here there is a door buster folder I believe I've actually shown you guys this before but
doesn't hurt to show it again and I always choose the medium list because I like to be as robust as
possible we can start with the nibbles blog directory so we say nibble blog here.
I keep calling it nibbles because that's the name of the machine but definitely never blog.
And then we know it's a BHP extension.
We could totally look for the just BHP if we wanted to look for more we could say like text back files
zip files rar files PD f any kind of extension you want here just for the sake of purpose in time say
we're just going to search for BHP and we'll go ahead and start that on the Neville blog itself.
Now it's already finding a ton of info.
We go to the tree view I like the tree view.
You can see there is index admin install update site map.
OK.
So there's a lot of stuff here for for this in particular.
Now we found the ad in the area by just guessing the admin area and if we did some research on the blog
we probably could have found where the ad in Page was as well we could say hey Neville where where's
nibble at the Neville blog at.
Right.
So we see some interesting information and you can see it's pulling down a ton of files through here
as well.
So I'm gonna go ahead and actually just stop this.
We don't need to run this whole thing.
So here here's some things we can do it read a novel blog admin area.
Now this won't have default credentials right.
This is somebodies personal blog.
And in order to save time or it is going to talk through this process what we could do is build out
a brute force similar to the last episode where recaptured or intercepted here and we attempted to we
could use brb suite at an intruder right and tried to do a username and password something along the
lines of admin or administrator and then use a common bad password list here and see if we can get in.
We could also go to the naval blog page itself if we just go back let me delete this and we'll just
go to Neville blog and we could come here and if there were actual blog information we can use a tool
something like cool C E W L and try to pull down information we could pull down words off of this list
and we can say hey what words do they use in their blog that maybe we can perhaps relate to them and
use as a password we don't need to do that here there's not a lot but if we look at some words on here
the password actually ends up being right here with nibbles so navels is going to be our password there's
actually a time now I believe we enter into many incorrect users and passwords so we're not going to
do that.
And if you're interested in brute forcing with brb sweet episode 5 I believe it was the episode where
we took brute forcing in we we used Barb sweet to do that.
So let's just go ahead and type in admin and then lower case just type in Neville's and you'll see that
we get access to the page so we have access.
We need to determine if this is actually four point zero point three because that's important right.
We need to know if this is the right version for us so we can go into settings here.
If you just click around what you should be doing as well as enumerating this whole application.
If you log into an application you should be looking at what you can do.
Can you upload.
Can you be malicious.
You can manage pages or settings there's themes there's all kinds of stuff in here right.
But if we come to the settings page here on the first settings tab and we scroll all the way down you
could see that we are running Neville blog for point zero point three.
This is money.
This is confirmed right.
We have what we need.
We've got user credentials.
We can effectively do this.
So let's do this.
Let's go back to our Metis void that we had.
I'm going to close out this door buster here OK.
So if we looked at our our options show out with our info as well.
So we need a password required.
We need to target your eye.
OK.
And we need a user name.
So we also need our host.
So we're gonna have to supply a few things here.
Let's go ahead and set the password to nibbles.
We'll set the username to admin we'll set the.
Our host is it host or hosts our hosts to ten at ten ten seventy five.
And I believe we're going to need to set the target your eye to add mend P HP and I could be incorrect
here but we'll see.
OK.
Now let's show options again real quick.
And we only have one target.
This looks OK.
Everything looks like we set it correctly.
So let's go ahead and type run and see if that works OK.
So that didn't work because I am dumb if you notice we're actually at navel blog slash admin.
So let's set the target.
You are I to let's just try and have a blog first and then I think it actually knows where the admin
directory is.
So let's just do for its national log and then we'll run this.
There we go.
Now we've got a session so you can see what it's doing is it's uploading a malicious image that BHP.
And if you want to see where that's happening at.
We come into our settings here and go into plug ins and under plugins there's a mind image if you actually
go to configure here you could see that we have the ability to upload an image.
Now this image we're uploading is a dot BHP that should not be happening right.
We should have some sort of black listing going on or white listing on extensions that we want to run.
But if we try to upload a BHP file we're allowed to do so since we're allowed to do that we can then
call that BHP file execute it and get a reverse shell on this system.
So easy easy breezy here.
So now you've got a shell we can do this info and look at some information here so this is good information
off the bat.
We can see that we've got a four point four point zero Ubuntu to one of the four generic.
We always want to look for this for privilege escalation purposes.
So for not the high level user let's get our you idea real quick.
We're not a high level user we're one thousand won here.
So you can see nimbler we are not root.
So we're going to need to do some prove ask one very very nice thing to do is to just search the Ubuntu
on this and look for privacy.
That's one of the first steps we would do.
But let me go ahead and get into the machine will type shell and let's look at the present working directory
or print working directory.
OK.
Let's go into the home folder and who am I.
We are enablers.
Let's see into nimbler and then let's just LSI real quick so let's Alana stash Ella.
I see what's going on here.
OK.
So a couple of things we can grab the user dot text file here.
We also have the ability to type out or sorry Cat the user dot text.
We have the ability here to look at a few things.
One that I always like to look at.
Right off the bat is history.
OK.
The history commands not found.
Now the history command would show us all the history that the user had typed previously.
Now in this instance we don't have it.
Commands I found that's fine.
But in historical purposes you never know if a user typing in a password or so some source some sort
of credentials there.
I can't talk today apparently.
Another place to look as you see that bash history we could as cat bash underscore history and see if
there's anything there.
And unfortunately there's not.
So what can we do here.
Well another thing that I like to do before I go searching and hunting for privacy is I like to do a
pseudo dash owl and this might take a second on this machine as machines having a little bit of timeout
issues.
It could be with our outer shell that we have here since we don't have t y interaction but that's OK.
Just give it a second.
And once that happens we'll we'll take a look.
But so pseudo dash L is for no passwords.
So if you don't know it's sudo is pseudo is running as an admin or running a command or a privileges
route or admin and it requires a password to do that.
So if you're not familiar with Sudo maybe go back and learn some more Linux and just get a little bit
more familiar with the basics of Linux.
Here we're able to run a command without a password.
So if we wanted to do something for example let's say cat ADC shadow we wanted to get a shadow file.
Permission denied.
Now we might be a member of the pseudo group right.
And we could say pseudo at the shadow or the pseudo ours but we need to enter a password here and we
don't know the password.
We didn't get in with the password.
So unless we stumble across the password or we figure out the password then we're kind of stuck.
But we have the ability to run something without a password here and it's as monitored as age in our
personal stuff folder.
So we can stash L.A. again and you can see there is no personal or stuff folder so there's gonna be
no monitor essays as well.
What that means is we have the ability to create a shell script here in these folders and get malicious
but a couple things before we actually root this machine.
So this one's pretty straightforward on what it can do.
And I think the next video we're going to do is going to be somewhere around the pseudo dash elegans
you can see how these things sort of work and how we might have to do a little bit of investigative
measures.
So what we've got here is we've got some enumeration we could do.
There's this personal Zip.
And if in the back of your mind you're saying what's that personal zip perfect thought process right
we should download this in a perfect world enumerate it see what's in there see if there's any password
protections try to crack those etc. But just for the sake of time this video so doesn't run too long
we're not gonna go down that rabbit hole.
I'm going to show you the ways in now there are some good scripts out there.
See it wasn't this obvious to us or there wasn't a pseudo dash L and there's no history and we search
on the the we can type you name you name dash a we search on the you name here and we look for this
this Ubuntu and Google and say hey privilege escalation on four point four point zero dash one or four
generic and nothing comes up.
OK that's another step that we could take others and exploits for this.
None of that comes up.
Well there are some great scripts out there and I'm going to leave you to do your own research on this
but there is a script called Lynn in room that s h there is also a Linux crib checker dot pie.
Both of these are absolutely gold when it comes to enumerating Linux most Ubuntu Linux machines come
with Python install then almost always they can run shell right so they can run these bash scripts.
So with that being said maybe a challenge to you in this video is to go find these download them and
then transfer the files onto these machines.
How do we transfer the files.
Well we'll do an example real quick and then I'll let you figure out how to run these and execute them.
So we need to create a malicious file that will allow us to run as root.
Here we have a home nibble or we need to create a new folder called personal and we need to make a proceeds
into that to make a new folder called stuff C.D. into stuff.
And if we print the working directory OK we're there.
So now we need to make a malicious file.
Right.
We've got a monitored sage we can do.
We can do a touch monitored SDH or we can do.
We can actually just echo a command into there if we want.
We could echo bash dash II and we can just say put that into a monitored ice age something like this
less and then you cat that monitor ice age and see that it just says Bashar I or dash I will explain
this here in a second.
Now I did say I was gonna do a file transfer.
We could do the exact same thing with W get say we're over here and we we made that file.
I'm just going to show you again.
Say we all make it over here.
Echo bash dash II into monitored SDH and OK we should be able to cap monitored.
Assange should be fine.
Now we can start up Python dash and simple a CTP server on port 80 and I'm not going to actually grab
this file but you guys should have seen this before right.
Well we would just do a W get here or curl.
If we need to w get on HP whatever your IP address is here slash monitored stage and I would get that
file as well so we could use the echo command here and make it straightforward.
So how do we exploit this now and what are we doing.
Why did I just do this bash Dash I will bash Dash I just means bash interactive what we're about to
do with a pseudo command is we can run this file as pseudo and make it execute right and when we execute
it's going to echo out or it's gonna run this script was just as bad.
Josh shy it's going to get me interactive bash shell that interactive bash shell is going to be run
as root because we're executing it with Sudo as root.
Now one thing that we should do here is we should make this file executable if we allow stash L.A. you
can see the permissions here say that we are not executable.
We only have read write access right now.
So let's change this to executable as well and you should always do this on your shell scripts and we'll
say Alice dash L.A. one more time and you can see now the Xs have been added.
OK so with this let's go ahead and sudo this script here.
Let's just say pseudo monitor dot H run that it might take a second.
We could say who am I.
Let's see if this actually works.
So again we're timed out here.
You could see that at time now earlier on a command as well.
So this machine has a little bit of timeout issues.
So just give it a quick second here to load.
And there you go.
And again it says we're nimbler.
Let's try it one more time and say who am I.
And we are still nimbler.
What's our I.T..
We are still nimbler.
Why are we still nimbler.
Let's take a look again.
So if we can monitor SDH
bash dash I II.
Let's try running this as pseudo home nimbler personal stuff monitor dot s age
and then we'll do it.
I.D. at the end of this and let's give this a go see if this works
and again if you want these scripts all you got to do out there is go out there and Google these.
These are great.
You should find these here on pretty easily.
Let's go to Google and I see we've got our shell back linen room to H download.
You see that.
So reboot user on this one and then Lynn probe checker.
There's actually a Linux privilege escalation.
Oh here we go.
Next privilege escalation scripts down here net SEC.
Pretty good as well.
I'll let a new line checker this got milk blog is actually really good too.
So if you check out the got no blog you can see all the different commands that we're not going to cover
today but he did a great job putting this blog together on what you should be looking for.
And then people went out and automated tools that will help do that same stuff for you.
All that searching for you all the hard work.
So we had you run this and we we tried to pseudo this monitor we had to run the full directory with
monitor in there and that will actually allow us to resolve to the idea of root so doing this pseudo
here does not work doing it this way will work.
So now you can see we are route we can go ahead and take advantage of that by going to the root folder
TWD.
OK.
So we are route at navels right.
So easy easy.
We can.
Alas.
And there's the raw data text.
I keep wanting to do.
I've been working in windows so much lately you can't keep saying type cat or dog text and you can get
your red flag as well and go submit those.
So that is it for this lesson from here.
There is a box that I want you guys to do that box is called optimum luck for the box optimum.
And go ahead and give that a go in the next video we'll cover that as a precursor and then we'll go
into another lesson but give optimum go and see if you can do it on your own.
Give yourself a little confidence and see if you can't root that on your own.
And we'll go from there.
Other than that.
Thank you so much for joining me.
And until next time.
My name is a cyber mentor and I will catch you later.