VULNHUB INFOSEC PREP : OSCP

Welcome to the walkthrough of InfoSec Prep: OSCP walkthrough. It is a beginner-level boot2root machine and it can be downloaded from here.

I cracked this machine literally 5 minutes after it booted properly. So you can consider this machine the easiest. 

Hint:

1. Nmap
2. Finding secret.txt and decoding it.
3. Login via ssh.
4. Privilege escalation to root via SUID binary. 

Boot up the machine and it should show the IP address.

We start off by pinging the box to verify that the box is up and running and we can reach out to it.

Command: ping <IP>

Then we can run Nmap scan to look for open ports and services running on the box.

We will use -sC for running default scripts, -sV for Version/Service info and -T4 for faster execution, and -o for saving the result on a file named nmap

The command is: sudo nmap -sC -sV -T4 <IP> -o filename

Looking at the scan results, port 22 is open and running ssh, and port 80 is open, and it's running Apache.

We can also see a directory named secret.txt as a disallowed entry in the robots.txt file. 

# Port 80 Enumeration

The web server has some content regarding the challenge that was released with the box.

But there's some useful info too. it tells you clearly that there is only one user on the box named "oscp".

So we know a username. Let's visit the secret.txt file that we found in the Nmap scans.

Looking at the content we see lots of text, but if you look it ends with "==" which means this may be base64 encoded. Copy the contents to your system and decode it using the command.

cat secret.txt |base64 -d

So it is a ssh private key. Now we have a username and a private key. Let's try logging in via ssh.

But first, remember to modify the permission for the private key.

Command: chmod 600 key

Log in via ssh: ssh -i key oscp@<IP>

And we log in successfully. Since we logged in as oscp we need to do some kind of privilege escalation to gain root access.

# Finding SUID binaries

Use the command: find / -perm -4000 2>/dev/null

We can see bash is set to SUID and abusing it is very easy.

Run the command bash -p and we are root.

Grab the root flag.

# Root via cronjob.

 If you visit the home directory of oscp user, there is a bash script named "ip" that's running as a cronjob. Since the file is in the user's home directory we can edit it and put our reverse shell into it and when cronjob runs we get a shell as the root user.

Add the reverse shell into the bash script.

Set up a Netcat listener to catch the reverse shell.

Command: nc -nvlp 1234

# Privilege Escalation by abusing lxd group.

First, we need to find the absolute path to lxc and lxd binaries to run the commands.

After the pool has been created we just need to run these commands on the victim.

And we are root users now.

Thanks for reading.