7MS #182: Vulnhub Walkthrough - SickOs
Intro
The following is a semi-spoilerish walkthrough of the SickOs VM from Vulnhub by D4rk.
It has (as best I can tell) a sequential pwnage path, meaning that I think you could read this write-up in order and not prematurely ruin any surprises.
Disclaimer
I'm intentionally not posting a full walkthrough with all the juicy details for a few reasons:
-
Full (and better) walkthroughs already exist online.
-
By not posting the full details, it allows you the chance to get just a little push in the right direction without ruining the entire challenge.
-
I like to show my full thought process as I do a whole lot of stuff wrong before I start making good progress. We can both likely learn something from that :-)
Write-up
An NMAP scan revealed port 22 open, so I started brute-forcing that just for fun :-). There's a secondary port open which, open exploration, looked to be a proxy of sorts that I could use for deeper scanning.
At this point, the next bit of recon required learning how to pipe various tools through the proxy to get clean results. By using a combination of vulnerability scanners and Web crawlers, I discovered additional content pointing to several possible attack vectors. One was a packaged content management system that looked to have some weaknesses if a valid account was available.
However, I went with what looked to be the path of least resistance - a published vulnerability with a fairly straightforward exploit path. However, I failed at using Metasploit through a proxy, so I tried another URL-fetching tool with some proxy settings and that got me my initial shell.
With the initial shell I went back through the content management system and discovered a key username/password combination in one of the system files. I tried to use it to sudo as a local account but the creds failed. However, after enumerating the users actually residing on the system, the username/password combination still proved to be of value.
From there, there was only one step left to getting root. After running privesc scripts and looking for other kernel-level exploits or advanced attacks, I went back to enumerating the basics. Then the answer was easy - and right in front of me :-)