Kioptrix is another “Vulnerable-By-Design OS” (like De-ICE, Metasploitable and pWnOS), with the aim to go from "boot" to "root" by any mean possible. This video demonstrates a well-known out-of-date issue in "mod_ssl". Because it wasn't too complex, I extended the video by removing the attacker from some log files.
Watch video on-line:
- Scan network for hosts (nmap)
- Scan target for running services (nmap)
- Scan target for running web services (nikto)
- Discover and run exploit (OpenFuckV2)
- Gain root (OpenFuckV2)
- Game Over
- Modify logs (0x333shadow)
- Kioptrix - Level 1 VM. Download here
- VMware player OR workstation. Download here
- nmap – (Can be found on BackTrack 4-R2). Download here
- nikto - (Can be found on BackTrack 4-R2)
- Internet Browser – (Firefox can be found on BackTrack 4-R2)
- A Text Editor – (Kate can be found on BackTrack 4-R2)
- OpenFuckv2.c – (Can be found on exploit-db.com)
- ptrace/kmod local root exploit – (Can be found on securityfocus.com)
- 0x333shadow.tar – (Can be found on packetstormsecurity.org)
A quick general nmap scan shows what host are on the network currently, before doing a more detailed scan on the target (192.168.0.111). By doing this, nmap shows what possible services (ports) the target has running and the version of the service and then attempts to identify the operating system (OS). The result of this are:
- OS: Linux v2.4.x (2.4.9-18)
- Web Server: Apache httpd 1.3.20 ((Unix) (Red-hat/Linux)) mod_ssl 2.8.4/OpenSSL 0.9.6b
The next stage was to use nikto to allow the attacker to detect what vulnerability(s) were being run on the web server. Nikto identities that the version of mod_ssl is "vulnerable to a remote buffer overflow which may allow a remote shell" [CVE-2002-0082, OSVDB-756].
The attacker then searches an exploit database (exploit-db.com), which return a couple of exploits. The chosen exploit was labelled as "OpenFuckV2.c".
The exploit needed to be modified to compile on the attackers computer due to updated library files for OpenSSL, as well as updating the link for the privilege escalation exploit
As the exploit targets “mod_ssl”, it inherits the same privilege as the user which is running the service (in this case “apache”). If the current privilege isn't enough for the attacker to reach their goal then they must use privilege elevation attacks to gain further access to the system. In most cases, the targeted account would be the highest user, “root”. This would allow the attacker to control anything on the target's system.
Once the attacker has a remote shell, the next few commands check the objective (which is displayed on the login screen locally) and the local environment as well as the password file.
The attacker has been using their machine directly, as well as hosting all the necessary files on their machine, therefore, to attempt to cover their traces they remove their IP address from various locations. This is done by using a program called "0x333shadow".
The attacker runs 0x333shadow which removes traces of the attackers IP in all default log directories, binary files (utmp, wtmp, utmpx, wtmpx, lastlog) as well as scanning “syslog” and “newsyslog” to try and detect other log locations. The attacker commands 0x333shadow to remove the logs after 5 seconds of running the 0x333shadow, allowing them to remove all traces of the program itself.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59
- This is a well-known old vulnerability, and has a few different variations on the exploit.
- OpenFuckV2.c (which uses "ptrace-kmod.c") might not gain "root" if the target doesn't have gcc installed or not using a vulnerable kernel version.
- The attacker may be logged by another service, which 0x333shadow might not remove.
- Just because the logs have been deleted, doesn't mean you have covered all traces. For example, forensics tools can recover deleted files.
- As the target only communicates with attacker, instead of using a 3rd party, it helps simplify with removing logs.
Video length: 06:22
Capture length: 19:31