Vulnhub Milnet writeup

Milnet exploitation

All information can be found in www.vulnhub.com and there are some awesome walkthrough :P

Goal: Attack this machine and got root privilege on this machine

-----Summary------
1. information gathering
2. exploitation by redirect to our own payload
3. escalate privileges
-------Start---------

After download and open it, here is VM login page, which includes IP addr. It means we can skip use arp-scan 

If you want to use 2 VM as attacker and victim, make sure they can communicate(in same subnet)

You need to configure to same interface in your computer

Then start information gathering--NMAP scan, this time I use -A option to scan, which don't need root privilege.

And we got port 22, 80 are open. 

First we start from port 80--http. Enter IP addr, can see the webpage

 But it looks like don't have any important information, so we use dirb in my Kali Linux 

Based on the wordlist, it can go through and see if there's any webpage within this server.

From the result below, I got two pages

This info.php looks interesting, after took a look, there's cgi and php functionally, which is a good thing for upload my payload to server

From the information I got, instead of upload payload file, I decide to redirect the server to execute my payload and connect through netcat base on http protocol.

First step is start my apache server, then copy my payload file into it and save as txt format.

 Second is ensure my listener IP and port number in my payload file.(I use payload file is in Kali linux /usr/share/webshell/php/php-reverse-shell.php. My goal is try to let victim server execute this payload file)

 Base on the information I got in the website, I found the picture file is base on directory route to file.

It is a really awesome information for attacker since you can redirect the route to your own backdoor file.(Here is my php-reverse-shell as example.)

So I use burpsuite to edit my request

1) Use POST method rather than GET

2) Set the content-type let browser can decode and execute the payload file

3)add the route parameter in the end, ensure the server can execute my Kali payload file.(Here my Kali IP is 172.16.194.136, victim's IP is 172.16.194.135) 

Open the netcat and start to listen the connection 

After get into the server, there's a thing is really interesting as a hint.

Is the DefenseCode_Unix_WildCards_Gone_Wild.txt,

this file also available from here: http://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt

Basically is a way to do command injection for an arbitrary command on operating system 

The following command is injection I use on victim server. It's set to open a shell after netcat connection form other host

This is the final result, after I connect to server and have root privilege in this shell.

Thanks for watching :)