I’m back and finally ready to walkthrough DC-5 from VulnHub. This one was much harder than the previous DC boxes but teaches some important skills. You can also find my video walkthrough of it here. Now let’s get started.
We start off with our usual nmap scan.
Here we see a web port with nginx running. The nginx part will be important later. For now let’s just visit the website.
Navigating through the site doesn’t reveal much. Let’s run gobuster and see if we can find anything more.
gobuster dir -u 192.168.2.128 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php
Running this command will produce the following results:
Most of these we’ve already seen just from navigating the site, however, thankyou.php is new. You can also find it by completing the contact form.
The thankyou.php page doesn’t look too interesting until you refresh it a few times
The footer changes dates. You can see where this is coming from by looking at footer.php from our gobuster scan. Since this is weird behavior, let’s try a local file inclusion (LFI) method and see if that works.
The ?file=/filepath is common but not exclusive. We could have used a program like wfuzz to run through multiple possibilities quickly, but we didn’t need to.
Now we can read any file we have rights to. Let’s see if we can find the log files. Remember the nmap scan? Because of that, we know that this server is nginx. Let’s see if we can read the configuration file for nginx. If you don’t know where it is, Google is your friend.
We now know where the access and error logs are stored. Let’s see if we can read those.
We can read them. If you get to this point and you can’t see the logs, try reverting the box. I had to do that a few times when the logs just wouldn’t show up.
We can also see our previous viewing of the password file and our user agent. From here, we can attempt to poison the logs and get code execution. We can do this by sending PHP code in our user agent string. I’m going to use curl to do this, but BurpSuite would work as well.
Here I sent the whoami command inside some PHP code as the user agent. Let’s check the log page now.
We have code execution! Let’s see if they have netcat installed. I’ll run the curl command again but change whoami to which nc.
Let’s hope it has the -e flag. First, we’ll setup our netcat listener (nc -nlvp 7777) and then send our netcat reverse shell to the logs. Once we refresh the log page, we should have a shell.
And we have a shell!
Let’s upgrade it with python
After the python command I’m pressing ctl-z to background the connection. Then I type stty raw -echo followed by fg to bring the connection back to the foreground (which you can’t see on the screen). That allows me to have ctl-c, tab auto complete, up arrow history etc.
Now it’s on to privilege escalation.
I’ll run linuxprivchecker.py (I’ve renamed it here to privcheck.py) but I’ll have to bring it over. To do that, I’ll start a python web server and then use wget to do the file transfer.
Now I can run it with python and view the results
This SUID set screen file stuck out to me as interesting. It’s not normal to see it here and screen is used for terminal sessions. I’ll run searchsploit against the version listed and see if I get any hits.
Ok it looks like it’s vulnerable to a privilege escalation exploit. There’s only one problem. It doesn’t work out of the box. The script doesn’t seem to follow the EOF markers like it should. It might be fixable as a whole, but it’s easier for me just to break it up manually. Thankfully the code isn’t too hard to follow.
There are three main stages to this exploit. Two compile steps and a final exploit step.
These three sections should be broken out as shown. The .c files should keep their names exactly. The sh file can be called whatever you want. Compile the .c files using the gcc commands in the script making sure to change the file paths to fit your environment. You’ll get some warnings, but that’s ok.
When you are done compiling, you should have a libhax.so, rootshell, and your script file.
Now I’ll bring the files over with wget.
Now I’ll set the script permissions to execute and run it.
And we’re root!!!
Now for the flag …
That’s DC-5. Like I said earlier, this was a lot harder than the previous DC boxes in the series. It does cover some solid techniques that pentesters should know. I did have a problem with the access logs not showing up at all. There were a few times I had to revert the box to get it to work which was really annoying.
Anyway, I hope you enjoyed the walkthrough. If you would like to see a video walkthrough that does a better job explaining the privilege escalation exploit, you can find it here.