Hack the Lord of the Root VM (CTF Challenge)

This is another Boot2Root challenge which has been prepared by KoocSec for hacking exercises. He prepared this through the inspiration of his OSCP exam. It is based on the concepts of great novel-turned-movie The Lord Of The Ring.

Firstly, we will find our target.

Our target is
Now run the nmap script to know the ports and protocols.
nmap –p- -A

Nmap has resulted in showing us that only 22 port is open with the service of SSH. Port 80 is not open that means we don’t have facility of opening this server in browser. Therefore we will try to see what port 22 has to offer and so go to your terminal in Kali and type :
When I searched SSH it said “Knock Friend To Enter” and “Easy as 123” and then it asks for password that we do not know yet. Now this is a hinting towards port knocking. Let’s try it :
nmap –r –Pn –p 1,2,3
-r : is scanning ports consecutively
-Pn : is treating all hosts as online
-p : is only scanning specified ports
1,2,3 : ports (we used this because of the : easy as 1,2,3)

Now again fire up nmap scan. This time hopefully we will have more than one port in result.
nmap –p- -A

As you can see there is one more port open in comparison to our previous scan i.e. 1337 which has the service of HTTP and this is all we wanted as by default port 80 was not open. Let’s open our target IP with this port.

It opens a page with only one image. There was nothing in the page source too. So, I used nikto here.
nikto –h

Every directory shown in nikto’s result wasn’t useful. So, I tried robots.txt as I always try it by default.

And BOOM! I was right as an image opens here. And further I checked its page source.

In the page source I found a Base64 code which I decoded using HackBar.

And it gave me the result as shown above but here is a trick. It is going to be further decoded but only from L till = as this is the base64 coded string. Similarly, decode it further.

Upon decoding we have a URL. Lets open it.

And now we are face to face with a log in portal. Now here I will try to log in with any random username and password but I this process we will also capture cookies via BurpSuite.
As the cookies are captured, we will use them in our next step i.e. sqlmap. Now I wanted to gather database to know username and password that is why I decide to use sqlmap. And the command I used is :
sqlmap -u –forms –batch –crawl=10 –cookie=ibf29bpuc0864gmfobpdsg0pu0 –level=5 –risk=3 –dbs
When you execute this command it will ask you three questions. Answer first two questions as no and the third one as yes.

And it will start gathering database.

And finally it will show you the database of usernames and passwords.

Moving on save all of these usernames and password in two different text files. And use this text files in an SSH log in attack with the help of Brute force method. And to execute this attack go to the terminal in Kali and open Metasploit by typing msfconsole and further type :
use auxiliary/scanner/sh/shh_login
set rhosts
set user_file /root/Desktop/user
set pass_file /root/Desktop/pass
And as a result it will show you the correct username and password i.e. smeagol:MyPreciousR00t. now log in through SSH using this username and password.
Next give the password when asked. And when you are logged in then type the following command to know version of kernel.
lsb_release -a
The version is 14.04 and luckily we have an exploit for this version. In the Kali terminal lets search for the appropriate exploit and for this type :
searchsploit ubuntu 14.04
The exploit we will use here is 39166.c and for this exploit to be used we need to first download and compile it and for this type :
gcc 39166.c –o shell
The first command in the above commands will download the exploit and the second one will compile it and save it in the file named shell. Next, we have to give permission to the shell and then at last we have to run it.
chmod 777 shell
Executing the shell file will take you to the root and to confirm this use the following command :
Now let’s get into root folder and see what it has to offer :
cd /root
Here, we have found a text file with the name flag which was our ultimate goal. So now no more waiting, lets read it.
cat Flag.txt

Author: Yashika Dhir is a passionate Researcher and Technical Writer at Hacking Articles. She is a hacking enthusiast