SickOs: 1.1 – VulnHub Writeup

Source: https://www.vulnhub.com/entry/sickos-11,132/

Some initial notes:  The SickOs series has been recommended by a lot of people to be fairly similar to OSCP labs so I figure it should be some good enriching practice.  I think I’m going to try to make it a point with each new writeup to either try out some new tools, or at least use past tools in new or more focused ways for better efficiency.

Though this VM is built for VMWare, I’ve always been more of a VirtualBox guy so we’ll start off by importing the machine into VBox.

To do so create a brand new VM in Virtualbox with the following settings:

Name: SickOs 1.1
Type: Linux
Version: Ubuntu or Debian (64-bit)
Memory: At least 512MB
Hard Disk: Do not add a virtual disk

Extract the *.7z to its own folder.

For the new VM right-click into Settings, then go to the Storage tab.

Under either the SATA or IDE controller, click Add New Storage Attachment, and select the SickOs *.vmdk file that was extracted earlier.   From here you should be able to start up the VM as usual and be all set.  Settings should look similar to below:

Now we can start the actual writeup!

Instead of my usual netdiscover I’ll utilize the SANS NMAP Cheat Sheet and use nmap to do just an initial host discovery scan of my subnet.

nmap 192.168.111.0/24 -sP

101 is the Kali box, so we’ll be targeting 192.168.111.100.  Let’s now do a service discovery and try to detect the OS:

nmap 192.168.111.100 -O -sV   // -O for OS detection and -sV for service enumeration

We might be able to brute-force SSH, but let’s come back to that later when we have more intel.  We have an open web-proxy so let’s try configuring Firefox to use it and see what happens.

After doing so and then hitting 192.168.111.100 itself (localhost) we get this site to come up:

Nothing interesting in the page source here.  Let’s piggyback off the proxy to do a nikto scan of the webserver.

nikto -h 192.168.111.100 -useproxy http://192.168.111.100:3128/

 

https://www.exploit-db.com/exploits/34900/

At this point the exploit seemed to hang, so I think we’ll need to pass the specific vulnerable page as a parameter instead:

Success!  Remembering back to all the news around Shellshock it’s a little frightening now to see how easy this vulnerability was to detect and exploit.

So we’re a system user.

We get a good list of possible IDs to hijack here.  At this point I poked around the filestystem for quite a while and then ended up in /var/www (what better way to enumerate what’s available on the webserver?)

Some terminal weirdness aside it looks like the server also runs WolfCMS.  Let’s check it out in our browser.

http://192.168.111.100/wolfcms/?admin/

Now we have the admin login screen.  Let’s probe some more in the WOLFCMS directory to see if it lists users anywhere or where to find them.  Looking through the config.php it doesn’t appear we will be able to brute-force the password without changing the config first.