Kioptrix 1.3 (#4)

November 18, 2019 45 Comments

This guy: https://www.vulnhub.com/entry/kioptrix-level-13-4,25/

We’ll start with a standard nmap scan of: nmap -sv 192.168.41.132 (or whatever the target IP is.

Next, we run enum4linux and get 5 users and some OS information:

And then we’ll run dirb for good measure: dirb http://192.168.41.132

And it looks like there’s a couple of directories in there, including an /images one and /john

Exploit Hunting

Next, let’s go to the login page. Since we got a few usernames during our initial exploration, we’ll try logging in with robert and then putting a ‘ in for the password, in an attempt to see if the website is vulnerable to SQL injection.

And it looks like it’s vulnerable. Time to try and exploit.

SQL Injection Exploit

We’ll try with our username of robert and a password of 1′ or ‘1’=’1 and let’s see what happens.

That was almost a little too easy. Let’s save that information and see if we can get some of the other user’s we enumerated, like John.

We notice that when we log in there really isn’t much we can do with this website. But our initial discovery showed that SSH was open on port 22, so let’s try to log in.

SSH


Logging in with SSH quickly shows us that we have a limited shell. We can’t even run commands like pwd. Some more information on limited shells can be found here, including how to get around them: https://www.aldeid.com/wiki/Lshell

We can elevate it to a regular, interactive shell, with the following command: echo os.system(‘/bin/bash’)

From here, we can see that we can run some standard commands in our window, like PWD. We can even navigate to the root directory without problems.

Next, let’s see what is currently running with root privledges, by typing the command ps -ef | grep root

It looks like the MySQL database is running as root. Let’s see if we can look at some of the MySQL configuration files for interesting information: ls /var/www

It looks like there’s a checklogin.php file in that directory, so we look at it and see the following:

The SQL database has no password associated with it. Since there is no password for the database, and it’s running as root, we can try to execute a user defined function to do privilege escalation. This will allow us to execute commands on the operating system itself as root.

To do this, we need to verify that lib_mysqludf_sys.so is installed, so we can use the whereis command to verify. It’s there, right where it’s supposed to be:

Access to Root

We need to get into the MySQL database to run these commands: mysql -h localhost -u root -p

Next, we run this command: select sys_exec(‘usermod -a -G admin john’);

Usermod allows us to modify a user, -a means append, -G will add them to a group (admin in this case) and then we put the user we’re modifying.

Type exit to get out of MySQL, and do su john, enter the password you found, and then verify your access and location with whoami and pwd.

45 thoughts on “Kioptrix 1.3 (#4)”

  1. That is the right weblog for anyone who wants to seek out out about this topic. You notice so much its virtually laborious to argue with you (not that I really would need…HaHa). You undoubtedly put a brand new spin on a topic thats been written about for years. Nice stuff, simply great!

  2. Great work! This is the type of info that should be shared around the web. Shame on Google for not positioning this post higher! Come on over and visit my site . Thanks =)

  3. Aviator combines air travel with high stakes.
    Jump into the cockpit and play through cloudy adventures for massive payouts.
    With its retro-inspired visuals, the game evokes the spirit of pioneering pilots.
    https://www.linkedin.com/posts/robin-kh-150138202_aviator-game-download-activity-7295792143506321408-81HD/
    Watch as the plane takes off – withdraw before it disappears to secure your earnings.
    Featuring smooth gameplay and dynamic audio design, it’s a must-try for gambling fans.
    Whether you’re testing luck, Aviator delivers non-stop action with every round.

  4. Este site é realmente demais. Sempre que acesso eu encontro coisas incríveis Você também pode acessar o nosso site e descobrir mais detalhes! conteúdo único. Venha descobrir mais agora! 🙂

  6. hi!,I like your writing so much! share we communicate more about your post on AOL? I need an expert on this area to solve my problem. Maybe that’s you! Looking forward to see you.

  9. It is appropriate time to make a few plans for the longer term and it is time to be happy. I have read this put up and if I may just I desire to counsel you some attention-grabbing things or advice. Perhaps you could write next articles referring to this article. I desire to read more things approximately it!

  10. After study a few of the blog posts on your website now, and I truly like your way of blogging. I bookmarked it to my bookmark website list and will be checking back soon. Pls check out my web site as well and let me know what you think.

  16. Hi! This is kind of off topic but I need some guidance from an established blog. Is it very difficult to set up your own blog? I’m not very techincal but I can figure things out pretty quick. I’m thinking about making my own but I’m not sure where to begin. Do you have any ideas or suggestions? Many thanks

  17. Pretty section of content. I just stumbled upon your web site and in accession capital to assert that I get in fact enjoyed account your blog posts. Anyway I’ll be subscribing to your feeds and even I achievement you access consistently fast.

  18. I haven’t checked in here for a while because I thought it was getting boring, but the last several posts are great quality so I guess I will add you back to my everyday bloglist. You deserve it my friend 🙂

  19. Wonderful work! This is the type of info that should be shared around the net. Shame on the search engines for not positioning this post higher! Come on over and visit my web site . Thanks =)

  20. Hello! I could have sworn I’ve been to this website before but after checking through some of the post I realized it’s new to me. Anyhow, I’m definitely delighted I found it and I’ll be bookmarking and checking back frequently!

  21. Awsome article and right to the point. I don’t know if this is really the best place to ask but do you guys have any thoughts on where to hire some professional writers? Thanks in advance 🙂

  22. Having read this I thought it was very informative. I appreciate you taking the time and effort to put this article together. I once again find myself spending way to much time both reading and commenting. But so what, it was still worth it!

  23. Usually I do not read post on blogs, but I would like to say that this write-up very forced me to try and do so! Your writing style has been surprised me. Thanks, quite nice post.

  24. Great weblog here! Additionally your website loads up very fast! What web host are you the use of? Can I am getting your associate link to your host? I want my site loaded up as fast as yours lol

  25. Thank you for sharing superb informations. Your web site is so cool. I’m impressed by the details that you’ve on this website. It reveals how nicely you understand this subject. Bookmarked this website page, will come back for more articles. You, my friend, ROCK! I found simply the info I already searched all over the place and just could not come across. What an ideal site.

  28. Hey there! Someone in my Myspace group shared this site with us so I came to check it out. I’m definitely loving the information. I’m book-marking and will be tweeting this to my followers! Fantastic blog and amazing design.

  30. Great article and right to the point. I don’t know if this is in fact the best place to ask but do you people have any ideea where to employ some professional writers? Thx 🙂

  32. obviously like your web site but you need to take a look at the spelling on quite a few of your posts. Several of them are rife with spelling problems and I to find it very troublesome to tell the truth then again I will certainly come back again.

  33. Wow! This blog looks exactly like my old one! It’s on a totally different subject but it has pretty much the same layout and design. Great choice of colors!

  34. You really make it appear so easy with your presentation however I find this matter to be actually one thing which I believe I might by no means understand. It sort of feels too complex and very large for me. I’m having a look forward for your next publish, I’ll attempt to get the grasp of it!

  36. Ebenfalls ist das Angebot so kundenfreundlich gestaltet, dass kein zusätzlicher
    bwin Bonus Code für die Aktivierung genutzt werden muss.
    Dazu benötigt es lediglich eine geringe Mindesteinzahlung von 10€, was auch für Anfänger gut machbar sein sollte.

    Das Unternehmen sitzt auf Malta (Tipico Tower, Vjal Portomaso, STJ 4011, St.
    Julian’s) und hat neben Slots auch Sportwetten im Programm.

    Tipico ist ein erfahrener Komplettanbieter, der schon seit 2004 am
    Markt ist. Ebenfalls stellt der Anbieter 10 Freispiele ohne Einzahlung für das aktvieren von SMS-Nachrichten bereit.
    Mit der Bonusaktion setzt Bwin auf einen klassischen Einzahlungsbonus, der das Guthaben verdoppelt (wenn die richtige Zahlungsmethode benutzt wird).
    Haben Spieler die Anforderungen erreicht, wandelt Bwin den Neukundenbonus in auszahlbares Guthaben um.

    So findest du zum Beispiel viele Automatenspiele mit Cash Collector,
    Clustern, Kaskaden, Hold and Wins sowie expandierenden Wild Symbolen.
    Bei meiner bwin Erfahrung haben mir zudem die Money King Slots
    und Megaways Slots sehr gut gefallen. Was die Arten der Spielautomaten angeht, so sind klassische Früchte-Slots, moderne Video Spielautomaten, Megways und Bonus Buys Spiele zu finden. Schließlich befinden sich unter den Spielautomaten mehr als 650 verschiedene Titel.

    Das liegt vor allem daran, dass der Anbieter eine
    deutsche Glücksspiellizenz besitzt, die Tisch- und Live Spiele sowie progressive Jackpots verbietet.
    Nur Sportwetten und einige Poker-Spiele ergänzen das Portfolio des Angebots in der
    Online Spielothek.

    References:
    https://online-spielhallen.de/wildz-deutschland-test-bonus-spiele-2025/

  37. Für neue Kunden gibt es einen großzügigen Willkommensbonus von bis
    zu 500€ plus bis zu 50 Freispiele obendrauf.
    Seitdem hat sich die Spielhalle einen erstklassigen Rang in der Branche erarbeitet und wird von Casinospielern auf der
    ganzen Welt geschätzt. Kann ich im Vulkan Vegas Casino mit Kryptowährung spielen? Ferner gibt es zwar viele Bonusangebote,
    aber die No Deposit Boni setzen sehr viel Einsatz und Spielrunden voraus,
    was für Gelegenheitsspieler nicht attraktiv ist. Solltest du unterwegs spielen wollen, dann kannst du dir für Android die Casino
    App installieren. Es sind auch VIP-Tische vorhanden, an denen Highroller hohe Einsätze machen und ungestört spielen können.
    Dabei kann man sich auch verschiedene Willkommensprämien sichern, unter anderem Freispiele, Startguthaben und Einzahlungsboni.
    Die Plattform hat einiges zu bieten, von einer immensen Auswahl an Slots
    und Tischspielen über Live Casino Angebote und Turniere.
    Melden Sie sich im Vulkan Vegas Online Casino an und
    beginnen Sie mit dem Spielen von Slots, Tisch- und Kartenspielen. In diesem Fall spielen die Höhe der
    Einsätze und der Automat keine Rolle. Der Jackpot wird unter allen Personen, die im Vulkan Vegas Casino um echtes Geld spielen, ausgelost.

    References:
    https://online-spielhallen.de/beste-online-casinos-deutschland-top-10-nov-2025-3/

  44. Do you have a spam issue on this site; I also am a blogger, and I was curious about your situation; we have created some nice methods and we are looking to swap techniques with others, be sure to shoot me an email if interested.

  45. I wanted to write a quick note to be able to say thanks to you for these superb steps you are showing here. My extended internet look up has at the end of the day been compensated with beneficial facts and techniques to exchange with my company. I ‘d assume that we visitors actually are unequivocally lucky to dwell in a useful site with many outstanding individuals with beneficial basics. I feel quite lucky to have discovered the site and look forward to really more exciting minutes reading here. Thanks again for all the details.

Leave a Reply

Your email address will not be published. Required fields are marked *