Kioptrix 1.1

File name is Kioptrix level 2 - CentOS 4.5

The vuln machine

0. Get machine's IP

  1. sudo netdiscover -r <IP> to scan our network for devices (found 4 hosts - kali, host, vuln machine, vmware)

1. Enumeration

1.1 Enumerate services

1.2 Enum4linux

1.3 Checked http apache webserver at port 443

By right should always check web vulnerabilities last

2. Exploit Action

Here we begin exploiting every attack vector possible : ssh, apache httpd, rpcbind, mysql

2.1. OpenSSH

22/tcp open ssh OpenSSH 3.9p1 (protocol 1.99)

SSH failed to work due to unavailable suitable attack vectors.

2.2 Apache webserver

Searchsploit apache version

Searchsploit hacks

  • searchsploit -x <path of exploit> : opens the source code of exploit file

  • searchsploit -u : update searchsploit from expoitdb database

  • searchsploit -p <path of exploit> : copies exploit to clipboard

  • searchsploit -m <path of exploit> : copies exploit file to your directory (REMEMBER TO cd or create new dir for this!)

mod_ssl is an optional module for the Apache HTTP Server. It provides strong cryptography for the Apache v1. 3 and v2 webserver via the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) cryptographic protocols by the help of the Open Source SSL/TLS toolkit OpenSSL. This fits our purpose :

# Download the exploit to our makeshift directory

Do always try to read the source code to see requirements for exploit, there's so many things you can learn from reading scripts!

For this we stored it in ~/home/searchsploit_stuff as OpenFuck.c

  • note the requirements of libssl-dev (apt-get install libssl-dev)

  • Compile with: gcc -o OpenFuck OpenFuck.c -lcrypto (replace OpenFuck.c with the name of your downloaded exploit .c file)

TO BE CONTINUED

PreviousVulnhub MachinesNextTryHackMe

Last updated