Vulnhub Machines Walkthrough Series — Tr0ll: 2

August 21, 2018 by

Security Ninja

Today, we'll be continuing with our walkthrough series on interesting Vulnhub machines. In this article, we will see a walkthrough of the Tr0ll: 2 virtual machine.

Note: For all these machines, I have used VMware workstation to provision the VMs. Kali Linux VM will be my attacking box. Also, remember the techniques used are solely for educational purposes' I am not responsible if the listed techniques are used against any other targets.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

Tr0ll: 2 Overview

Download it here.

VM Details

• The next machine in the Tr0ll series of VMs. This one is a step up in difficulty from the original Tr0ll but the time required to solve is approximately the same, and make no mistake, trolls are still present! :)
• Difficulty is beginner++ to intermediate.
• The VM should pull a valid IP from DHCP. This VM has been verified to work on VMware workstation 5, VMware player 5, VMware Fusion, and Virtual box. Virtual box users may need to enable the additional network card for it to pull a valid IP address.

Walkthrough

1. Download the Vulnix VM from the above link and provision it as a VM.
2. Following the routine from this series, let's try to find the IP of this machine using Netdiscover. From below, we can see that the IP address is found as 192.168.213.130.

1. As is the norm, we ran Nmap scans on all ports (since this is a troll, so not taking any chances). We got hits on 21, 22 and 80 (and robots.txt as well).

1. Let's start collecting more information around the discovered ports.
2. Below, we can see that we are welcomed by a troll.

   

3. Since we also got a hit on robots.txt, let's examine its contents as well. Below, we can see that there are lot of directories mentioned here, some of them being .jpgs.

1. Browsing all of them and downloading all the images, I found an interesting thing about their size. Most of them are of same size except one, as we can see below.

1. Let's perform some static analysis on the .jpg file. Running strings on the file shows an interesting text which is telling us to go to y0ur_self.

1. Following the lead, it is a successful hit with a .txt file.

1. Below are the contents of the answers.txt file. This looks full of base64-encoded strings.

1. Below is how we are decoding the contents of the answers.txt file.

1. Below are the contents of the base64-decoded file.

1. Now let's remove the duplicates from the file. Okay, but now what? What are these strings? If they are passwords, then where are the usernames to try with? We're completely stuck at this point, so let's revert back to the enumeration phase.

1. With Nmap scans, we found port 21 open also. Let's try to enumerate that. The username is guessed from the source code on the port 80 landing page.

1. We can see that there is a lmao.zip file. We collected that file and tried opening it, but it looks like it needs a password.

1. Let's use fcrackzip (excellent utility) and pass it the unique .txt file generated earlier and the zip file. Below, we can see that we got a hit.

1. Unzipping the contents reveals an RSA private key. Woohoo!

1. Let's try to login with this key as user noob… annnnnndddd we got a TRY HARDER LOL!

1. Repeating the process with verbose mode on, we see that a COMMANDS has been set up for authorized keys for user noob. So the question is, how can we bypass this?

1. After a bit of research it was discovered that Shellshock can be used here. Below, we can see that we have used the Shellshock vector.

1. And we are in! First thing I always do is to upgrade my shell.

1. Checking for files where SUID bit is set, we got lot of hits. Interesting ones are like nothing_to_see_here/choose_wisely.

1. Navigating to the abovementioned directory we see three doors, and each of them has an executable. INTERESTING. To add to that, these files are changing folders after a certain time.
2. Opening the file in door 1, I got a file r00t and executing it restarts the system.

1. Executing another file (r00t) in door 3 locks me out for two minutes. You can look at my struggle below.

1. In the meantime, the files changed directories and the only file which was left moved to door 1. This file requires some input.

1. Providing some input (As) displays them back.(Dr00lling.)

1. Testing it with 500 As shows a seg fault. (Oh yeah!)

1. Following the buffer overflow steps, we're creating a pattern of 500 random characters with pattern_create in Kali.

1. Debugging the application within GDB shows that the EIP is overwritten by a value (possibly some part of our random characters).

1. Checking the position of the identified value using pattern_offset shows that the position is located at 268.

1. Redoing the same exercise again, we now inserted 268 As and four Bs. We got the EIP replaced without Bs, which means that we can control our EIP and thus can use it to point to out shellcode.

1. So now we'll make EIP point to the ESP value where our shellcode will reside. But before we do that, we need to find a reliable ESP address. It's very important to note that OS loader places the environment variable before stack areas that vary, so it will directly affect the ESP address. Also, how the program is invoked is very important.

   Below we try invocation with env and unsetting LINES and COLUMNS. We got the ESP address below:

1. Grabbing the shellcode from here.
2. Invoking the script in same way (env -) we can see that we are root and got Proof.txt. We win!

Awesome box! Some interesting things to know, like the COMMAND setting with keys and the importance of program invocation. This box has less trolls than the original one and offers greater learning.

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

We will continue this series with more Vulnhub machines. Thanks for reading!