Vulnhub: LazySysAdmin 1 – CTF attempt

I’ve never tried a VulnHub box before. I initially downloaded the Bulldog one but couldn’t even work out what its IP address was! LazySysAdmin 1 caught my eye. Apparently created as the author failed his OSCP – my kind of guy and this one seems to pick up DHCP OK so found it on 192.168.3.20

First off some nmapping to see what’s there:

Initial Enumeration

(makes it sound like I have a formal plan, which I don’t, but should)

So looks like an Ubuntu box running a web server, SSH, samba shares, a MySQL database (probably for the website) and an IRC server.

This is the bit in the process I start to worry – lots of things there and not sure which one to go for first. Starting at the top of the list: OpenSSH 6.6.1p1. Googling doesn’t offer up any obvious exploits. I’m sure there is a better way of running service versions through a tool to find these – need to find out.

Apache 2.4.7 – this has exploits by the look of it but the site I looked at had “none” in every instance in the column marked “access gained” so that doesn’t look promising.

So onto the website. Firefox to the IP and a site pops up. Not actually much there. Buttons don’t do anything. Links go nowhere other than a couple of external ones at the bottom of the page.

So now what? Consult my course notes. Doesn’t seem a lot of point in using Burp as no transactions are taking place although maybe its Spider would find things. Dirbuster seems like a better shot. Maybe there are some hidden directories and files, what with it clearly being an unfinished mock-up website. I choose directory-list-2.3-small.txt wordlist as I don’t want to be waiting an age. It immediately starts finding an absolute shed-load of stuff.

 

It’s running WordPress in the /wordpress directory, we can get to phpmyadmin (a web interface for managing SQL databases) and there are some other folders. Visiting the site:

 

Is someone trying to tell us something here? Several times? And is his name togie? Jot that down as a possible username for later. Not much else to see here. Maybe give wpscan a spin with a general scan:

 

WPSCAN

The most interesting thing this finds is:

The vulnerability involves setting a different email for password resets. Since this machine is on my network I’m not sure how useful that is.

Hooray. We have a login name: admin

wpscan gives some options and one of them is to bruteforce the login with an known username so I try that:

That looks like it’s going to take a while and whilst it’s revving my laptop fan, I’ll see what else I can be looking into.

SAMBA shares

Time to dig out my pentesting course notes on null shares. First thing my notes suggest is nmblookup

the <20> means there is an active share on the computer called LAZYSYSADMIN

smbclient -L lists the shares and the -N switch tells it not to use a password

So there is a share there called “share$” In the meantime I’ve turned off wpscan’s password forcing as I’m scared my laptop will die from heat exhaustion. Now everything is strangely quiet as I pull the next tool from the badly written Word print out I’m working off:

The actual output is mahoosive and I’ve stripped most of the crap away. Important things, IMO, are:

• It allows null sessions
• We can list and map share$
• There is a user called nobody (I think?)
• There is a unix user call togie

My notes say we can connect to shares with smbclient \\\\host\\sharename -N with the -N meaning null session (i.e. user/pass not required)

I’ve got an smb session here and some files and folders, some of which are recognisable from the Dirbuster scan. So looks like this share contains the website stuff. I could use smb commands like get to get the files but I’m gonna try Kali’s file browser first.

Fill in the server details: smb://192.168.3.20/share$ and now I’ve got a much easier way of browsing the share and it satisfies the Windows admin in me. Files first:

todolist.txt: “Prevent users from being able to view to web root using the local file browser” – it’s a bit late for that now son.

deets.txt: “CBF Remembering all these passwords. Remember to remove this file and update your password after we push out the server. Password 12345“

Nothing interesting in robots.txt. I try writing to the share but not allowed.

But we have a password and two usernames: admin and togie. Can I log onto the share using these credentials I wonder? Well not sure really. Using the username togie works but then it accepts any password and commands to write to the share are still not allowed.

I’l check out the folders. To cut a long story short, there is an important WordPress file called wp-config.php

So now we have credentials for the mysql database. Admin and TogieMYSQL12345^^ I try connecting from my kali box but it says:

Assuming I’m not doing something wrong (ha ha good one) then looks like remote connections are not allowed. Maybe the myql creds come in handy later. The securi-tay box used them to get root privs so you never know.Actually, Dirbuster told us about access to myphpadmin so maybe the creds come in handy there?

But before that, let’s try out some of these credentials on the Lazysysadminbox:

Really? That’s it? Weird. So nothing fancy with WordPress or myphpadmin required? I’m gonna ssh into it now simply because it’s easier to copy and paste the code to this blog

In a nutshell: couldn’t get to the root folder. Sudo su accepted togie’s 12345 password. Now have full access and capture the flag.