Kioptrix Level 3

---

After running the Kioptrix virtual machine, the IP address of the machine can be searched through the "netdiscover" that searches for the current network address.

netdiscover's result

It shows that the machien's IP is 192.168.64.133. The result of the port scan for this IP is as follows.

nmap's result

It can be seen that a total of two well-known ports have been opened. Also i cound find a "phpmyadmin" in this host by using "nikto"

nikto's result

Let's get into the 80 port. I find a login service using "LotusCMS".

LotusCMS login service

And I find a exploit code about LotusCMS in github.

GitHub - Hood3dRob1n/LotusCMS-Exploit: LotusCMS 3.0 eval() Remote Command Execution

After setup my listening IP and Port, i can get a reverse connection from the host.

set up options

reverse connection successful

By gathering more information, I was able to find the "gconfig.php" file which includes some database credential.

DB credential

 

It works! And i could find some more credential from the dev_accounts table.

dev_accounts

By using CrackStation. I can find the hash value's type and result.

CrackStation - Online Password Hash Cracking - MD5, SHA1, Linux, Rainbow Tables, etc.

hash crack result

And successfully login into dreg by using ssh.

ssh login

Now, let's try some privilege escalation. I listed loneferret's privileges and found a interesting instruction.

loneferret's privileges

I'm going to using the ht editor to get root privilege.

enter ht editor

ht editor's panel

Press F3 can go intothe open mode.

try to edit sudoers

Let's try to edit sudoers file and add "/bin/bash" to loneferret.

add /bin/bash

Save and quit the ht editor. And just check if it works.

success!