DC416-FORTRESS
- Layout for this exercise:
1 - INTRODUCTION
- The goal of this exercise is to develop a hacking process for the vulnerable machine DC416-fortress
- DC416-fortress can be downloaded from here:
https://www.vulnhub.com/entry/dc416-2016,168/
- Once downloaded and extracted with VirtualBox:
2 - ENUMERATION
- Searching for the IP with netdiscover:
- Scanning with Nmap we discover that there are 3 open ports (22, 80 and 443):
- Going to the web server it is redirected to HTTPS, informing us that there are 3 flags to be found:
- Using dirbuster against the web server with the small size wordlist:
- A file called scanner.php is detected:
- Same result with dirb and the wordlist big.txt:
- Let's see how scanner.php works:
- Trying to bypass the scanner with ; | & there is no result, probably they are filtered characters:
3 - INTERCEPTING WITH BURP
- Intercepting the scan with Burp and sending to Repeater:
- We discover that a "carriage return" allows to bypass the filter for the scanner, for instance using the command id the response is successful:
- Reading the file scanner.php we understand the details about how the filters are implemented:
- Also, we can find some flag text files:
- Even the content of the 1st flag:
- Although it is possible to go further with the Burp attack, we decided to take another way.
4 - EXPLOITATION WITH COMMIX (COMMAND INJECTION EXPLOITER)
- commix helps us to run an automated Command Injection attack:
https://github.com/commixproject/commix
- Some options for commix:
- In our case let's provide as options the URL to be attacked and the data string 'host=127.0.0.1' sent trough POST:
- The pseudo terminal allows us to achieve inner information from Fortress in an easy way:
- Listing content:
- Code from scanner.php:
- Checking what type of file is s1kr3t, it is a directory, and listing its content we have access to the 1st flag:
- Doing same thing with the directory k1ngd0m_k3yz and its content:
- Reading text files master and passwd:
- Although we could try to decrypt password for user craven, let's dig into its /home directory for now:
- For any unknown reason flag.txt is not accesible:
- hint.txt describes how to achieve craven's password:
- reminders.txt tells us that craven's pet's name is qwerty:
5 - CRACKING THE SSH PASSWORD WITH CRUNCH / MEDUSA / HYDRA / JOHN THE RIPPER
- Following instructions from hint.txt and reminders.txt we can use crunch to build a list of passwords with the pattern %%%qwerty^ where % represents all possible numbers and ^ represents a symbol:
- Creating a passlist of 33000 lines:
- Both medusa and hydra with passlist are able to find SSH credentials for user craven:
- Also John The Ripper can help us to decrypt the password.
- First, unshadowing:
- Applying john over u and passlist:
6 - LIMITED REMOTE SHELL
- Connecting to craven's SSH we achieve a limited remote shell:
- There are two /home directories:
- First, inside user craven's home directory we are able to find the 2nd flag:
- Then, going to /vulnhub we cannot open the 3rd flag:
- ./reader is an executable file that could help to open flag.txt:
- That is not possible at the moment:
- strings on reader gives us a clue about symlinks:
7 - SYMLINKS
- Creating a soft link we cannot read the flag:
- However, a hard link is accesible from ./reader and eventually we have the 3rd flag:
