[RogueCoder]

Information

Objective:
Perform penetration test on company server

Scenario:
The scenario for this LiveCD is that a CEO of a small company has been pressured by the Board of Directors to have a penetration test done within the company.
The CEO, believing his company is secure, feels this is a huge waste of money, especially since he already has a company scan their network for vulnerabilities
(using nessus). To make the BoD happy, he decides to hire you for a 5-day job; and because he really doesn't believe the company is insecure, he has contracted
you to look at only one server - a old system that only has a web-based list of the company's contact information.

The CEO expects you to prove that the admins of the box follow all proper accepted security practices, and that you will not be able to obtain access to the box.
Prove to him that a full penetration test of their entire corporation would be the best way to ensure his company is actually following best security practices.

Tools and methods used:

• nmap
  
• browser
  
• custom script (generate usernames)
  
• hydra
  
• openssl
  
• manual brute force
  

Step 1: Regular nmap and basic reconnaissance

Before we can play, we need to know what toys we have. So for this I started off with the most basic nmap scan, just to see what services that was running.

Code:

# nmap 192.168.56.103 Starting Nmap 6.25 ( http://nmap.org ) at 2013-05-23 21:05 CEST Nmap scan report for 192.168.56.103 Host is up (0.00044s latency). Not shown: 992 filtered ports PORT STATE SERVICE 20/tcp closed ftp-data 21/tcp open ftp 22/tcp open ssh 25/tcp open smtp 80/tcp open http 110/tcp open pop3 143/tcp open imap 443/tcp closed https

Since http is available I went to look at their website. I didn't expect much information since it sais in the scenario that it only served a single static page.
But any info is better than no info. So I launched my browser and navigated over there.

Spoiler:

The first thing that I saw was just some general info about the De-ICE. At the bottom there was a large CLICK HERE link that lead me to the challenge website.

Spoiler:

As expected there wasn't much there. Just a funny story related to the company and some other stuff. But there was some employee names and their email
addresses. What could I possibly do with this info? I wrote a script in Python not long ago actually, which generates possible usernames based on real names.
Well, that's at least what it was intended for

Get the script here: http://www.hackcommunity.com/Thread-Gene...-usernames

It generated a decent sized list of possible usernames, and I made sure Adam Adams, Bob Banter and Chad Coffee was the first usernames to try since these
were listed as administrators.

With this I moved on to the next step.

Step 2: Brute force ssh with hydra

In the nmap output I also saw that ssh was open and decided to use hydra and try to brute force my way in.

I have a decent amount of word lists and rockyou is one of my favorites. First off, it's not sorted alphabetically and second it's enormous. About 14.5 million words if I recall correctly.

Since bruteforcing through that many words for a single account is not very efficient I have used a script I've made for splitting large files into smaller pieces.

Get the scrpit here: http://www.hackcommunity.com/Thread-Spli...ller-files

I've created a rockyou collection that holds 50k lines per file. So I started at 001.

I use terminator as my terminal because of its native split functionality, so I split the screen and started hydra in one ...

Code:

hydra -s 22 -V -t 70 -e nsr -o hydra-result.txt -L usernames.txt -P /root/pentest/tools/wordlists/misc/rockyou/50k/rockyou-001 192.168.56.103 ssh

... and then I was tailing the hydra-result.txt in the other ...

Code:

tail -f hydra-result.txt

At this point, I launched my PS3 and played some rounds of Black Ops 2, and since it was kind of late already and the kids were gonna wake up early anyway I went to bed

When I woke up I got my son ready for kindergarden, and when I got home I checked my computer it had successfully brute forced Adam Adams' credentials

[spoiler='Credentials. Do you really want to cheat? ']Username: aadams
Password: nostradamus[/spoiler]


At this point I stopped hydra, removed everything related to Adam Adams from the list, moved the username combinations that were equal to Adam's to the top,
and started hydra again with the same wordlist and rearranged username list.

Why? Because if Adam changes his password I might still be able to use another account as the entry point.

That being said, it's time to log in

Step 3: Log in and privilege escalation

After logging in through ssh it was time for some reconnaissance work again. There was a couple of things I wanted to know before I continued.

1. What kernel version is this?

Code:

uname -a

2. What permissions does this Adam guy actually have?

Code:

sudo -l

After having the kernel version I went to Google and I did find an exploit. I was a happy camper until I tried wget (failed), vi/nano/pico (failed).
Then for some reason I decided to check it gcc would work at all... Which it of course didn't.

Time to think.. What can I use that will help me getting root access?

I decided to give unshadow+john a go. To get this to work I needed the content of both /etc/passwd and /etc/shadow.
So I changed directory to /etc and then cat to get the content.

Code:

# cd /etc/ # sudo cat passwd # sudo cat shadow

I saved the the content in files with the same names, and .txt extension. Next I runned unshadow on them

Code:

# unshadow passwd.txt shadow.txt > unshadow.txt

And then I used unshadow.txt with john

Code:

# john unshadow.txt

It didn't take long to get credentials for Bob Banter, and after a little bit of waiting it also got the credentials for root

Spoiler: Credentials

Bob Banter: bbanter / bbanter
Root: root / tarot

I could now easily log in as root through Adam's account using the su command and enter the password.

Step 4: More reconnaissance

After gaining root access I decided to check the /home directory. I started on top and worked my way down looking for anything of interest.
There was nothing until I came to the ftp account.

It contained a sub folder /incoming, which had a file named salary_dec2003.csv.enc. This I had to investigate further. So I outputted its content

Code:

# cat salary_dec2003.csv.enc

It turned out to be encrypted. So it was time to pay google another visit

Step 5: Decrypting the file

First I decided that I wanted to get the file over to my own computer and did this by moving the file to the web root ...

Code:

# mv salary_dec2003.csv.enc /var/www/htdocs

... then downloaded the file to my computer

Code:

# wget http://192.168.56.103/salary_dec2003.csv.enc

I could now analyze the file. I started by opening the file in my text editor and noticed that it said Salted__ at the top of the file. So I searched for
"salted__ header" in Google and found that this header is created by openssl. So, now it was time to try and decrypt it, but the only thing I knew
about the encryption was that is was created using openssl.

Time to pay Google another visit. I found some documentation and figured that the first thing I had to know was what type of cipher algorithms does
it have to offer.. So I made openssl print out the list for me using the following command

Code:

# openssl list-cipher-algorithms

And wow, this is going to take some time. Another thing was the key... I could of course try to brute force it, which meant I would learn how to write
a script for that as well.. While searching Google for how to execute shell commands in Python I recalled something I had seen early in the process.The passwd
file had a weird message in it..

Code:

root:x:0:0:DO NOT CHANGE PASSWORD - WILL BREAK FTP ENCRYPTION:/root:/

Could it be this easy? Could it be that the root password was the encryption key? I decided to give it a shot, and manually work my way down the list
of cipher algorithms.

So I started with the first one which was AES-128-CBC

Code:

# openssl aes-128-cbc -d in salary_dec2003.csv.enc -out salary.txt enter aes-128-cbc decryption password: [root password]

No error or confirming messages... I looked at the files in my folder and I saw salary.txt and decided to check it out

Code:

# head salary.txt

Success. The content had been decrypted and written to salary.txt.

I opened my browser and opened the level.php file which gives you hints and other info about the tasks.. The disclosed info is white text on white background,
so I highlighted the OTHER HINTS and it verified that all tasks had been solved.

Spoiler: Task list

- Interns tend to know nothing of security
- The ftp server is broken; it's supposed to be
- Even though the ftp server is broken, there may be residual files of interest; read the /etc/passwd file first, though
- If you get the CEO's bank account information, you've defeated this challenge. Congratulations!

Game Over
I hope you enjoyed this walk through. This was a really fun challenge since I had no clue about the tasks beforehand

[clik]

Really enjoying these walkthroughs. They are clear, complete and have a flavour of personality:thumbs:

[RogueCoder]

Thanks @clik Really appreciate the feedback. It motivates me to continue doing these writing these walk through's

[MrGeek]

Mate .. I have read your walkthrough .
I love it so much ...
Very nice post .
I'm waiting for upcoming posts.
Regards
Mr.Geek

[cracker_team_mybb_import7369]

Very nice post man i really liked it Keep it up

[RogueCoder]

Mate .. I have read your walkthrough .
I love it so much ...
Very nice post .
I'm waiting for upcoming posts.
Regards
Mr.Geek

Thanks man I'm working on the next De-ICE, but I'm stuck :headbash: Never penetrated through an anonymous ftp user before :wacko:

Very nice post man i really liked it Keep it up

Thanks, glad you enjoyed it

[Linuxephus™]

Excellent read and great tutorial Shpongl3.
You should start filing this under the Helpers tag (LightX would know how to do that) on your next walk-through/tutorial or even corroborate one with the other Members (infer suggestion, nothing more).:thumbs:

[RogueCoder]

Thanks @Linuxephus™ Glad you enjoyed it!

I'll check out the Helpers tag, and doing a challenge with other members would be fun and a great way to learn! That could even be a start on an idea I've had since I started my hacker journey

Been wanting to gather a group of people with the primary focus on making the open source community more secure, by doing white-hat penetration testing on both core applications and on 3rd party plugins. Then report findings to the developers, and let them patch then we publish the disclosure.

[Linuxephus™]

Thanks @Linuxephus™ Glad you enjoyed it!

I'll check out the Helpers tag, and doing a challenge with other members would be fun and a great way to learn! That could even be a start on an idea I've had since I started my hacker journey

Been wanting to gather a group of people with the primary focus on making the open source community more secure, by doing white-hat penetration testing on both core applications and on 3rd party plugins. Then report findings to the developers, and let them patch then we publish the disclosure.

That will more than likely indeed take some serious working together regarding your ideal. LightX should have the experience for just that *if* I'm not mistaken.
Meanwhile, indeed, LightX by request has been directly promoted to full time Helper's Leader, which leaves Syntax as his second now. So LightX can assist you in the manner of corroborating upon tutorials as a whole with the Helpers Group and where/how to file such.
And since he's now the Lead of Helpers, he'll group meeting all Members in the sub-forum on such.

[RogueCoder]

Is hydra can brute even if the ssh filter the login times? eg. 5 times & approx: time of your bruting ssh @shp0ngl3

If the server has a failed login attempts limit the approach I used here will not work.
I'm not sure how long it took, since I was playing PS3 and went to sleep But if I were to guess a few hours