Corrosion: 2 VulnHub WriteUp
Walkthrough for Corrosion 2 in VulnHub
Last updated
Walkthrough for Corrosion 2 in VulnHub
Last updated
Proxy Programmer’s Corrosion: 2 is a Vulnhub medium machine. This lab is designed for experienced CTF players who want to put their abilities to the test in a variety of situations. So, let’s get started and see how we can split things down into smaller chunks.
Corrosion2.ova (Size: 5.1 GB)
Download (Mirror): https://download.vulnhub.com/corrosion/Corrosion2.ova
Network Scanning
netdiscover
nmap
Enumeration
dirb
fcrackzip
Exploitation
Metasploit
/etc/shadow
john
Privilege Escalation
ssh
python library hijacking
root flag
Level: Medium
To begin, we must use the netdiscover command to scan the network for the target machine’s IP address.
The victim’s IP address, in this case, is 192.168.1.186.
We’re going to use Nmap to help us move this process along. To see all of the services stated, we need to know which ones are now available.
According to the nmap output, we have:
An SSH server is available on port 22.
On port 80, there is an HTTP service (Apache Server).
On port 8080, a Tomcat server is running on port 8080.
Let’s begin by looking at the http service on port 80. There’s nothing strange about that; it’s just an Apache server page.
Next, we looked at the Tomcat server, which was listening on port 8080. It’s a straightforward page with nothing suspicious on it.
We discovered nothing harmful on websites. So, to continue further in this experiment, we use the dirb directory brute force method to find some knowledge. Smash!! We discovered a directory containing a backup zip file.
The backup zip file is then downloaded using the wget command. Following that, we attempted to study this file, but it was password protected.
Next, we’ll use the fcrackzip utility to crack this password. It is a lightweight, open-source zip file password cracker. The rockyou word-list is used for the brute force attack. Boom!! We cracked its password in a matter of seconds (@administrator_hi5).
fcrackzip -D -p /usr/share/wordlists/rockyou.txt -u backup.zip
Then we use this password to unzip the backup zip file. We attempt to inspect each and every file contained in this backup zip file. We are now inspecting the tomcat users xml file.
Bam!! We discovered user admin and password melehifokivai credentials.
Now that we have the credentials, we can begin exploiting them using a Metasploit. In these instances, employing a Tomcat exploit is the best option. Then give us all the information we need to use it, and we’re ready to go. As you can see, we had a meterpreter session.
We just switched the directory to home. We discover that we have two users in this lab, Jaye and Randy. We switched to user jaye. It has the same password (melehifokivai) that we found out earlier.
We discovered that this individual has a look called the .program that allows us to locate any file. As a result, we use it to locate the /etc/shadow file. Boom!! We obtained the hash values of all users in this lab.
As you are aware, we already have the password for user Jaye. We copy user randy’s hash value and save it in a file called hash.
Using John, who is a specialist in this case, we try to crack that hash. In a matter of seconds, we cracked the password 07051986randy.
Now, we have all of the necessary information to begin privilege escalation. To login via ssh as user randy, we use the cracked password 07051986randy.
Then we used the (sudo -l) tool to examine this user’s limits. We discovered that it can be abused by python library hijacking.
The randombase64.py python code can be used to perform this hijacking. which imports another file called base64.
To obtain base64 file coordinates, we use the locate command. In a couple of seconds, we discover its coordinates. We investigated the file’s restrictions. Using this file, we can gain root access.
We made some changes to this base64 python file using the nano command. Add this code to get root access to the victim’s machine.
We are now coordinating the use of both Python files. Boom!! We obtained root access. We immediately changed the directory to root and received the root flag in a matter of seconds.
This was a fantastic lab with a lot of information, especially in the enumeration and privilege escalation areas. It is worthwhile to attempt to gain CTF experience. Hopefully, this walk-through should have taught you something new.
