> For the complete documentation index, see [llms.txt](https://meowsec.gitbook.io/vulnhub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://meowsec.gitbook.io/vulnhub/easy-1/list1/lampiao.md).

# Lampiao

An Easy, boot2root challenge

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVu5oh1kSSNv0TUUeFI%2F-MVu6f83yeGaG5CLYO7l%2F1.PNG?alt=media\&token=f232eaf9-4e4c-4676-8735-b9dee3de447d)

I have got the root access using three steps:

1. **Enumeration**: robots.txt reveals so much info
2. **Exploitation**: 2 ways to access one is SSH and another is Drupal vulnerability.
3. **Privilege Escalation**: dirtycow kernel exploit is there.

Now I'm going to describe my way to solve this.

### 1. Enumeration

(1) target IP is 10.0.2.28. I have started nmap scan first. 

```
nmap -sV -v 10.0.2.28
```

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVu5oh1kSSNv0TUUeFI%2F-MVu8EjXfkq9fx1hmbr7%2Fnmap%20scan.PNG?alt=media\&token=e89f42f7-94aa-426b-a7e7-626bdebbd7c1)

(2) After visiting port 80, I have not found anything interesting. But port 1898 reveals a webpage.

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVu5oh1kSSNv0TUUeFI%2F-MVu8mMGgiiK37JTMtXG%2Fweb.PNG?alt=media\&token=b7d70f18-abb3-422f-a04b-9bef0b690352)

(3) When enumerating a web, it's better to search for robots.txt at first. I have tried and this web reveals the robots.txt here.

(4) I have started to visit all the directory listed in that robots.txt file. But found nothing interesting. Suddenly in minimal.info file, I have found that, the site is running Drupal 7.54. In exploit-db, there is also exploit code for this. ([Exploit-db link](https://www.exploit-db.com/exploits/44449))

(5) SQL injection attempt failed as well as new password request. Because the mail server is not working in the background. 

(6) Found 2 username in the first page: tiago and Eder.

### 2. Exploitation (using SSH)

(7) From nmap scan, I have found that ssh is running. So let's try to brute force it. The problem is - wordlists available in the OS and in GitHub, takes a lot of time. Making one wordlist from the website could save some time. Let's try:

```
cewl http://10.0.2.28:1898/?q=node/1 -w pass.txt
```

(8) I have saved those username in username.txt and the wordlist in pass.txt. Now I am using hydra to brute force and gain ssh password.

```
hydra -L usernames.txt -P pass.txt -e nsr -f -t 4 ssh://10.0.2.28
```

And the brute force is successful. I have got username: tiago and password: Virgulino

(9) I can log in using this name and password

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVu9--UuYtjgWGJMtc2%2F-MVu9myhIw_FG12esFll%2FCapture.PNG?alt=media\&token=bf600d99-827b-4c81-9856-f4837e58f79a)

### 2. Exploitation (Using Metasploit)

(10) Metasploit search shows there are so many exploit already

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVu9--UuYtjgWGJMtc2%2F-MVuADlu0pUUkDb_AamY%2Fmetasploit.PNG?alt=media\&token=2d428da2-c179-4500-bec0-dc65de5b2f89)

(11) I am going to use drupalgeddon2 because it has excellent ranking.

```
use 4
set rhosts 10.0.2.28
set rport 1898
```

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVu9--UuYtjgWGJMtc2%2F-MVuAd8vTRPnHxpO8J7R%2Fmetasploit3.PNG?alt=media\&token=47d867ac-fa1c-4d6e-8ccf-ac11bb6ace63)

(12) After exploiting using run command I have got a shell. But it has only user privilege. I have started to search for those directories if I can get anything valuable. But there is nothing. There is a folder name tiago, but it also has nothing.

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVu9--UuYtjgWGJMtc2%2F-MVuApeNbST6L28KXtzU%2Fexploit.PNG?alt=media\&token=c392a997-0585-450e-8d17-c895a222aaf5)

### 3. Privilege Escalation

(13) I have tried to upload Linux exploit suggester. But it has no permission.

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVu9--UuYtjgWGJMtc2%2F-MVuB7ievQCaZnOu9uFD%2Fexploit2.PNG?alt=media\&token=56f480f7-24b3-4578-be39-bba92bac5c00)

(14) What if I try to upload in temporary (/tmp) directory? And that works. After downloading using wget, I have changed the permission and then run it.

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVu9--UuYtjgWGJMtc2%2F-MVuBEyqqykAulK3OzsZ%2Fexploit3.PNG?alt=media\&token=2cee4110-c67e-413e-bfa9-71855a07d603)

(15) After running it, it says that the OS is vulnerable to dirtycow, a well known kernel exploit.

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVu9--UuYtjgWGJMtc2%2F-MVuBLKDEZMKxHkXqkPB%2Fpriv.PNG?alt=media\&token=501e1b84-18db-4c65-bc7d-3353059d7b8b)

(16) I have downloaded that 40847. After that I have changed it to C++ file and permission.

```
mv 40847 40847.cpp
chmod +x 40847.cpp
```

Then I have compiled it. Remember, to compile this code follow the instruction described in the main exploit. ([Exploit-db link](https://www.exploit-db.com/exploits/40847)). Now I can run the exploit. 

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVu9--UuYtjgWGJMtc2%2F-MVuBiHxkTq_9LQhjom_%2Froot.PNG?alt=media\&token=1fbd0af5-3c56-4781-9e20-d83b5189f7b5)

(17) I was getting error while trying to access using root password. (Can't recognize why). So I have SSH again using the root password. And I become root!

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVu9--UuYtjgWGJMtc2%2F-MVuBrILecQmHYC7QqqD%2Ffinal.PNG?alt=media\&token=8f3a7e65-fdf7-4ebc-aaf5-188a02abcb04)

*Note: Privilege escalation is same for both - SSH exploitation and metasploit exploitation technique. That's why I have described once.*