Kioptrix Level 4

---

After running the Kioptrix virtual machine, the IP address of the machine can be searched through the "netdiscover" that searches for the current network address.

netdiscover's result

It shows that the machien's IP is 192.168.64.134. The result of the port scan for this IP is as follows.

nmap's result

It can be seen that a total of six well-known ports have been opened. And i used enum4linux command to check credential information about host. I got three ID (robert, john, loneferret).

enum4linux's result

Let's get into the 80 port.

SQLi

There is a login page, and I tried SQLi in this site with user john.

john's password

It works! And  I got john's password. Let's use ssh to get into the host.

get into host with ssh

But it seems it's a limited shell. The shell  only allows eight commands, including "echo". We can use echo command to open a new bash shell.

open bash shell

Now we are going to get root shell. I found there is a mysql configure information in checklogin.php.

mysql credential

I could use this credential to login into mysql and check more information.

mysql login

After a brief gathering of information, I found there is some function in mysql database.

func table's information

I can use sys_exec function to create a copy of "/bin/bash" and set its SUID bit so that we can access that copied binary as root.

copy /bin/sh to /tmp/getroot

Now let's execute the /tmp/getroot to get root privilege.

success