Kioptrix Level 2

---

After running the Kioptrix virtual machine, the IP address of the machine can be searched through the "netdiscover" that searches for the current network address.

netdiscover's result

It shows that the machien's IP is 192.168.64.132. The result of the port scan for this IP is as follows.

nmap's result

It can be seen that a total of six well-known ports have been opened. Let's get into the 80 port.

sql injection

We can find a login page and using easy sql injection to bypass the login logic like above.

index.php

Then, we are entry to the "index.php". I found that there is a command injection vuln in this page.

command injection

 

So we can using this vuln to open a reverse connection with our kali. Here is a very cool site to make a reverse shell code for you.

Online - Reverse Shell Generator

attaching reverse shell

reverse connection successful

And I found that the host is using Linux kernel 2.6 and running on CentOS.

find server's version information

Using these information to search a exploitable vuln. I cound find below vuln.

search exploit code

It's a privilege escalation which using the udp_sendmsg function. I'm going to get the exploit code and move it into the host by building a simple python server in kali.

get the exploit code

move exploit code to host

Complie the exploit code and execute it. We can easily get the root privilege.

privilege escalation